Vulnerability record · CVE-2019-16662 · published 28 October 2019
CVE-2019-16662: rConfig ajaxServerSettingsChk.php OS command injection via rootUname
Rconfig · Rconfig
rConfig 3.9.2 passes the rootUname parameter from a GET request to the exec function in ajaxServerSettingsChk.php without filtering, allowing OS command injection. Because the endpoint is reachable over the network with no authentication or user interaction, it is a straightforward remote code execution path on exposed installations.
Description
An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated network-reachable command execution with a CVSS score of 9.8 and very high EPSS probability, with public exploit code available.
What it is
rConfig 3.9.2 passes the rootUname parameter from a GET request to the exec function in ajaxServerSettingsChk.php without filtering, allowing OS command injection. Because the endpoint is reachable over the network with no authentication or user interaction, it is a straightforward remote code execution path on exposed installations.
Impact
An attacker can execute arbitrary system commands on the rConfig host, leading to full compromise of the application server and any data or credentials it holds.
Attack surface
Reached over the network via a GET request to ajaxServerSettingsChk.php with a crafted rootUname parameter; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.977 probability, 99.9th percentile) and multiple references are tagged Exploit, indicating public exploit code exists.
What to do
- Upgrade rConfig to a version later than 3.9.2 that fixes the rootUname command injection; check the vendor download page for the current release.
- If immediate upgrade is not possible, restrict network access to ajaxServerSettingsChk.php and the rConfig web interface to trusted management networks only.
- Deploy a WAF rule or input validation layer that blocks shell metacharacters in the rootUname parameter.
- Run the rConfig service under a low-privilege account so command execution does not yield root.
- Audit the host for signs of prior compromise and rotate any credentials stored or used by rConfig.
Detection
- Monitor web server logs for GET requests to ajaxServerSettingsChk.php containing shell metacharacters (;, |, $(), backticks) in the rootUname parameter.
- Alert on unexpected child processes spawned by the web server or PHP process, especially shells or command interpreters.
- Review outbound network connections from the rConfig host for signs of post-exploitation activity.
- Search for unexpected files or scheduled tasks created on the rConfig server.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-16662 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-16662), CISA KEV, FIRST EPSS (scores of 2026-09-25). This page is refreshed as NVD updates the record.
