CVE-2020-10221

rConfig suffered an OS command injection flaw allowing remote attackers to execute arbitrary system commands via the fileName POST parameter.

An OS command injection vulnerability in rConfig's ajaxAddTemplate.php file allowed remote attackers to execute arbitrary system commands by injecting shell metacharacters into the fileName POST parameter. This failure is critical for DIB organizations because it enables remote code execution, leading to potential data breaches, system compromise, and ransomware deployment. Organizations must ensure all software components are patched and monitored for known vulnerabilities, especially those listed in CISA's KEV catalog.

Shame score — The vulnerability was actively exploited in the wild and included in CISA's KEV catalog, indicating negligent patching and avoidable exposure to remote code execution.