How severe is CVE-2020-10221?

CVE-2020-10221 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2020-10221 being actively exploited?

Yes. CVE-2020-10221 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2021-11-03, which means active exploitation has been confirmed. It should be prioritised for remediation.

What products are affected by CVE-2020-10221?

CVE-2020-10221 affects Rconfig. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-10221?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.

Does CVE-2020-10221 have an EU (EUVD) identifier?

Yes. CVE-2020-10221 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2020-2679. It is also flagged as exploited in the EUVD (since 2021-11-03).

When was CVE-2020-10221 published?

CVE-2020-10221 was published on 2020-03-08 and last updated on 2026-06-17.

CVE-2020-10221

CVE-2020-10221 is a high-severity vulnerability in Rconfig with a CVSS 3.x base score of 8.8. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2021-11-03). The underlying weakness is classified as CWE-78.

Key facts

Severity: High (CVSS 3.x base score 8.8)
CVSS v2: 9.0
EPSS exploit prediction: 37% (98th percentile)
Actively exploited: Yes — listed in CISA KEV (added 2021-11-03)
EU (EUVD) id: EUVD-2020-2679
EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2021-11-03)
Weakness: CWE-78
Affected product: Rconfig
Published: 2020-03-08
Last modified: 2026-06-17

Description

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.

Frequently asked questions

What is CVE-2020-10221?: lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.
How severe is CVE-2020-10221?: CVE-2020-10221 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2020-10221 being actively exploited?: Yes. CVE-2020-10221 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2021-11-03, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2020-10221?: CVE-2020-10221 affects Rconfig. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-10221?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2020-10221 have an EU (EUVD) identifier?: Yes. CVE-2020-10221 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2020-2679. It is also flagged as exploited in the EUVD (since 2021-11-03).
When was CVE-2020-10221 published?: CVE-2020-10221 was published on 2020-03-08 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:*

More vulnerabilities in Rconfig

CVE-2020-15715 — Critical (CVSS 9.9): rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error…
CVE-2020-23151 — Critical (CVSS 9.8): rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since…
CVE-2020-13638 — Critical (CVSS 9.8): lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account…
CVE-2020-10549 — Critical (CVSS 9.8): rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes'…
CVE-2020-10548 — Critical (CVSS 9.8): rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes'…
CVE-2020-10547 — Critical (CVSS 9.8): rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by…

All CVEs affecting Rconfig →

Other CWE-78 (OS Command Injection) vulnerabilities

CVE-2026-56004 — Critical (CVSS 10.0): A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by…
CVE-2026-56415 — Critical (CVSS 10.0): Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is…
CVE-2026-56413 — Critical (CVSS 10.0): Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens…
CVE-2026-49869 — Critical (CVSS 10.0): Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in…
CVE-2026-49261 — Critical (CVSS 10.0): MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through…
CVE-2026-10520 — Critical (CVSS 10.0): An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a…

Browse all CWE-78 (OS Command Injection) vulnerabilities →