CVE-2019-19509: rConfig ajaxArchiveFiles.php path parameter OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 8.8 with a very high EPSS score and public exploit code make this a serious risk, though it requires an authenticated account.

What it is

rConfig 3.9.3 passes the path parameter from ajaxArchiveFiles.php directly to the exec function without filtering, allowing OS command injection. A remote authenticated user can run arbitrary system commands on the server, which matters because rConfig is a network configuration management tool often holding credentials and reachable from management networks.

Impact

An attacker with a valid account gains arbitrary command execution as the web server user, enabling data theft, configuration tampering, and lateral movement into managed network devices.

Attack surface

Reached over the network via a GET request to ajaxArchiveFiles.php; the CVSS vector (AV:N/PR:L/UI:N) indicates a low-privileged authenticated account is required and no user interaction is needed.

Exploitation

Not listed in CISA KEV, but EPSS is 0.71635 (99.4th percentile) and multiple references are tagged Exploit, including public PoC scripts, so exploitation is practical and likely.

What to do

• Upgrade rConfig to a version later than 3.9.3 that fixes the path parameter handling; verify the fix with the vendor before relying on it.
• Restrict access to rConfig web interfaces to trusted management networks and remove or disable unused accounts.
• Apply input validation or a WAF rule blocking shell metacharacters in the path parameter of ajaxArchiveFiles.php as a stopgap.
• Run the rConfig web service under a low-privileged account with no unnecessary filesystem or network reach.
• Audit accounts and rotate credentials stored in rConfig in case of prior compromise.

Detection

• Monitor web logs for GET requests to ajaxArchiveFiles.php with shell metacharacters or unexpected commands in the path parameter.
• Alert on child processes spawned by the web server user (for example sh, bash, curl, wget) from the rConfig application.
• Review outbound connections from the rConfig host to unusual destinations for signs of command execution and exfiltration.
• Check for unexpected files or modifications in rConfig directories and the web root.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.