CVE-2020-10221VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2020-10221: rConfig OS Command Injection Vulnerability

Affects rConfig rConfigSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 77.1% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-10221 (opens in a new tab)

Description

CVE-2020-10221 is an OS command injection vulnerability in rConfig affecting the ajaxAddTemplate.php file. Remote attackers can exploit this flaw by injecting shell metacharacters into the fileName POST parameter, enabling execution of arbitrary OS commands. This vulnerability has been exploited in the wild. No explicit affected versions or patch information is provided.

Summary

The vulnerability exists in rConfig's lib/ajaxHandlers/ajaxAddTemplate.php component, where insufficient input sanitization of the fileName POST parameter allows remote attackers to inject shell metacharacters. This leads to OS command injection, permitting arbitrary command execution on the affected system. The vulnerability is tracked as CVE-2020-10221 and has been observed exploited in the wild. No vendor advisory or patch information is available in the provided data.

Impact

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the rConfig server, potentially leading to full system compromise, data theft, or disruption of service. The presence of known exploitation in the wild indicates active threat usage.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and validate or sanitize inputs to the fileName parameter to prevent injection.

Weaknesses

CWE-78OS Command Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 08:56:22 UTC

Weaknesses

References

Related threats