CVE-2020-12259: rConfig configDevice.php reflected XSS via rid parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityCVSS rates it medium (5.4) and it requires authentication plus user interaction, but the very high EPSS score raises the likelihood of attempted exploitation.

What it is

rConfig 3.9.4 fails to properly validate user input in configDevice.php, allowing reflected cross-site scripting through the rid GET parameter of devicemgmnt.php. Because the payload executes in the victim's browser session, it can be used to steal session data or act as the victim within the application.

Impact

An attacker can run arbitrary JavaScript in a victim's authenticated browser session, enabling session theft, credential capture, or actions performed as the victim. The scope change in the CVSS vector indicates the script can affect resources beyond the vulnerable component.

Attack surface

Reached over the network through a crafted URL containing the rid parameter; the CVSS vector requires low privileges (PR:L) and user interaction (UI:R), so the attacker needs a valid low-privileged account and must lure a victim into clicking the link.

Exploitation

Not listed in CISA KEV and no public exploit tag is present in the references, but EPSS is very high at 0.96179 (99.875th percentile), indicating elevated predicted exploitation activity.

What to do

• Upgrade rConfig to a version later than 3.9.4 that fixes the input validation flaw in configDevice.php.
• If immediate upgrade is not possible, apply input validation and output encoding for the rid parameter and other GET inputs.
• Deploy a WAF rule to block script payloads in the rid and devicemgmnt.php request parameters.
• Restrict access to rConfig administrative interfaces to trusted networks or VPN.
• Enforce least privilege so accounts that can reach devicemgmnt.php have minimal permissions.

Detection

• Search web and proxy logs for requests to devicemgmnt.php with script tags, event handlers, or encoded JavaScript in the rid parameter.
• Monitor for reflected XSS payload patterns such as <script>, onerror=, or javascript: in URL query strings hitting rConfig endpoints.
• Alert on anomalous session activity or requests originating from a user session immediately after a suspicious devicemgmnt.php request.
• Review rConfig application logs for repeated or malformed rid parameter values from the same source.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.