Information Disclosure in rConfig Core by RConfig

CVE-2026-70555

What is CVE-2026-70555?

rConfig Core versions prior to 8.2.13 are susceptible to an information disclosure issue that enables authenticated users to access stored plaintext SSH, Telnet, and enable passwords through the device-credentials API. This vulnerability arises from the automatic decryption of sensitive information during read operations combined with insufficient authorization checks. Attackers can exploit this vulnerability by sending requests to the device-credentials API endpoints, effectively allowing them to extract sensitive plaintext device credentials using a valid token with administrator privileges.

References