RCONFIG CORE · CVE-2026-70555 · Other
NO FIX YET · SEE WHAT TO DO
rConfig Core 8.2.3 before 8.2.13 decrypts stored device credentials on read and does not check authorization on the device-credentials API. An authenticated user can retrieve cleartext SSH, Telnet and enable passwords for every managed device.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running rConfig Core from 8.2.3 up to but not including 8.2.13 are exposed, since any valid token or account can read stored device passwords through the API. rConfig Pro is stated as not affected. Anyone who can log in to the Core instance is in scope, so the risk is highest where many users hold tokens.
Not affected if rconfig-pro, version-8.2.13-or-later
Who cares network-devices, rconfig, ssh, telnet
8.2.138.2.13 or laterrConfig Core 8.2.3 before 8.2.13 contains an information disclosure vulnerability that allows authenticated users to retrieve cleartext SSH, Telnet, and enable passwords for managed devices through the device-credentials API due to automatic decryption on read and missing authorization checks. Attackers can request GET /api/device-credentials, GET /api/device-credentials/{id}, or the external GET /api/v1/device-credentials endpoint, which authenticates any valid token as the seeded administrator account, to statelessly exfiltrate all stored plaintext device credentials. rConfig Pro is not affected.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.