CVE-2026-70555

MEDIUM 6.5

rConfig Core 8.2.3 < 8.2.13 Cleartext Credential Exposure via API

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

rConfig Core 8.2.3 before 8.2.13 contains an information disclosure vulnerability that allows authenticated users to retrieve cleartext SSH, Telnet, and enable passwords for managed devices through the device-credentials API due to automatic decryption on read and missing authorization checks. Attackers can request GET /api/device-credentials, GET /api/device-credentials/{id}, or the external GET /api/v1/device-credentials endpoint, which authenticates any valid token as the seeded administrator account, to statelessly exfiltrate all stored plaintext device credentials. rConfig Pro is not affected.

CWE	CWE-862
Vendor	rconfig
Product	rconfig
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for rconfig rconfig

Be the first to know when new medium vulnerabilities affecting rconfig rconfig are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

rConfig / rConfig

8.2.3 < 8.2.13

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rconfig/rconfig/releases/tag/core-8.2.13 github.com: https://github.com/rconfig/rconfig/commit/090d4481acaf0003a33581eeb486a540414ff806 vulncheck.com: https://www.vulncheck.com/advisories/rconfig-core-cleartext-credential-exposure-via-api

Credits

komi Sergio Hognaglo (manasse)