Threats tagged 'ghsa-87rg-2gfw-4j68'

rConfig Core versions from 8.2.3 up to but not including 8.2.13 contain an information disclosure vulnerability. Authenticated users can exploit this flaw to retrieve cleartext SSH, Telnet, and enable passwords for managed devices via the device-credentials API. The vulnerability arises from automatic decryption on read combined with missing authorization checks, allowing attackers with valid tokens to exfiltrate all stored plaintext device credentials. This issue does not affect rConfig Pro.