{"id":"CVE-2026-70555","kind":"vulnerability","aliases":["CVE-2026-70555"],"related":[],"title":"rConfig Core: device-credentials API leaks plaintext SSH and Telnet passwords to users","description":"rConfig Core 8.2.3 before 8.2.13 contains an information disclosure vulnerability that allows authenticated users to retrieve cleartext SSH, Telnet, and enable passwords for managed devices through the device-credentials API due to automatic decryption on read and missing authorization checks. Attackers can request GET /api/device-credentials, GET /api/device-credentials/{id}, or the external GET /api/v1/device-credentials endpoint, which authenticates any valid token as the seeded administrator account, to statelessly exfiltrate all stored plaintext device credentials. rConfig Pro is not affected.","summary":"rConfig Core 8.2.3 before 8.2.13 decrypts stored device credentials on read and does not check authorization on the device-credentials API. An authenticated user can retrieve cleartext SSH, Telnet and enable passwords for every managed device.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"rConfig Core","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["network-devices","other","rconfig","ssh","telnet"],"not_affected_if":["rconfig-pro","version-8.2.13-or-later"],"how_to_check":"- Check the installed rConfig Core version against the fixed range `8.2.13`\n- Confirm the product is Core and not Pro, since the sources say Pro is not affected","fix":"- rConfig Core: move to `8.2.13` or later","status":"open","published_at":"2026-11-09T19:17:05+00:00","first_seen_at":"2026-11-09T19:28:21+00:00","triaged_at":"2026-11-09T19:30:15+00:00","updated_at":"2026-11-09T19:30:15+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-09T19:30:15Z","model":"claude-haiku-5-5","output":{"fix":"- rConfig Core: move to `8.2.13` or later","reach":"network","title":"rConfig Core: device-credentials API leaks plaintext SSH and Telnet passwords to users","impact":"high","summary":"rConfig Core 8.2.3 before 8.2.13 decrypts stored device credentials on read and does not check authorization on the device-credentials API. An authenticated user can retrieve cleartext SSH, Telnet and enable passwords for every managed device.","audience":"businesses","category":"other","nicknames":[],"who_cares":["rconfig","network-devices","ssh","telnet"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads every stored plaintext device password, including enable passwords","analyst_note":"","how_to_check":"- Check the installed rConfig Core version against the fixed range `8.2.13`\n- Confirm the product is Core and not Pro, since the sources say Pro is not affected\n- unknown whether a configuration check exists beyond the version","plain_action":"","product_name":"rConfig Core","needs_analyst":false,"not_affected_if":["rconfig-pro","version-8.2.13-or-later"],"who_is_affected":"Teams running rConfig Core from 8.2.3 up to but not including 8.2.13 are exposed, since any valid token or account can read stored device passwords through the API. rConfig Pro is stated as not affected. Anyone who can log in to the Core instance is in scope, so the risk is highest where many users hold tokens.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000761,"input_tokens":4712,"output_tokens":580,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-70555':17A,20A '/api/device-credentials':112C,114C '/api/v1/device-credentials':120C '8.2.13':34B,71C '8.2.3':32B,69C 'account':131C 'administr':130C 'affect':144C 'allow':78C 'api':6A,51B,97C 'attack':108C 'authent':53B,79C,123C 'author':45B,106C 'automat':100C 'check':44B,107C 'cleartext':57B,83C 'contain':72C 'core':2A,22A,31B,68C 'credenti':5A,38B,50B,96C,139C 'cve':15A,18A 'decrypt':35B,101C 'devic':4A,25B,37B,49B,66B,91C,95C,138C 'device-credenti':3A,48B,94C 'disclosur':75C 'due':98C 'enabl':61B,87C 'endpoint':121C 'everi':64B 'exfiltr':134C 'extern':118C 'get':111C,113C,119C 'id':115C 'inform':74C 'leak':7A 'manag':65B,90C 'miss':105C 'network':24B 'network-devic':23B 'password':12A,62B,88C 'plaintext':8A,137C 'pro':141C 'rconfig':1A,21A,27B,30B,67C,140C 'read':40B,103C 'request':110C 'retriev':56B,82C 'seed':129C 'ssh':9A,28B,58B,84C 'stateless':133C 'store':36B,136C 'telnet':11A,29B,59B,85C 'token':126C 'user':14A,54B,80C 'valid':125C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Teams running rConfig Core from 8.2.3 up to but not including 8.2.13 are exposed, since any valid token or account can read stored device passwords through the API. rConfig Pro is stated as not affected. Anyone who can log in to the Core instance is in scope, so the risk is highest where many users hold tokens.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["core","rconfigcore"],"ptokens":["core","rconfig"],"labels":["high","networkdevices","other","rconfig","ssh","telnet","vendor"],"campaign_type":null,"search_a":"'-2026':16A,19A '-70555':17A,20A 'api':6A 'core':2A,22A 'credenti':5A 'cve':15A,18A 'devic':4A 'device-credenti':3A 'leak':7A 'password':12A 'plaintext':8A 'rconfig':1A,21A 'ssh':9A 'telnet':11A 'user':14A","search_b":"'8.2.13':34B '8.2.3':32B 'api':51B 'authent':53B 'author':45B 'check':44B 'cleartext':57B 'core':31B 'credenti':38B,50B 'decrypt':35B 'devic':25B,37B,49B,66B 'device-credenti':48B 'enabl':61B 'everi':64B 'manag':65B 'network':24B 'network-devic':23B 'password':62B 'rconfig':27B,30B 'read':40B 'retriev':56B 'ssh':28B,58B 'store':36B 'telnet':29B,59B 'user':54B","search_c":"'/api/device-credentials':112C,114C '/api/v1/device-credentials':120C '8.2.13':71C '8.2.3':69C 'account':131C 'administr':130C 'affect':144C 'allow':78C 'api':97C 'attack':108C 'authent':79C,123C 'author':106C 'automat':100C 'check':107C 'cleartext':83C 'contain':72C 'core':68C 'credenti':96C,139C 'decrypt':101C 'devic':91C,95C,138C 'device-credenti':94C 'disclosur':75C 'due':98C 'enabl':87C 'endpoint':121C 'exfiltr':134C 'extern':118C 'get':111C,113C,119C 'id':115C 'inform':74C 'manag':90C 'miss':105C 'password':88C 'plaintext':137C 'pro':141C 'rconfig':67C,140C 'read':103C 'request':110C 'retriev':82C 'seed':129C 'ssh':84C 'stateless':133C 'store':136C 'telnet':85C 'token':126C 'user':80C 'valid':125C 'vulner':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-70555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70555","severity":null,"published_at":"2026-11-09T19:17:05+00:00","modified_at":"2026-11-09T19:17:05+00:00","first_seen_at":"2026-11-09T19:28:21+00:00","fetched_at":"2026-11-09T19:28:21+00:00","note":null}],"documents":[{"id":109392,"url":"https://github.com/rconfig/rconfig/commit/090d4481acaf0003a33581eeb486a540414ff806","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109393,"url":"https://github.com/rconfig/rconfig/releases/tag/core-8.2.13","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":109394,"url":"https://www.vulncheck.com/advisories/rconfig-core-cleartext-credential-exposure-via-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}