CVE-2020-13638: rConfig authentication bypass allows admin account creation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable flaw with a 9.8 CVSS score that yields full administrative control and has public exploit code.

What it is

rConfig 3.9.x before 3.9.7 contains an authentication bypass in lib/crud/userprocess.php that lets an unauthenticated attacker create an administrator account. Because the flaw grants full administrative access, it exposes the configuration management system and any managed network devices to takeover. The issue is fixed in 3.9.7.

Impact

An attacker gains a fully privileged administrator account on the rConfig instance, enabling control over device configurations and any credentials or managed systems reachable through it.

Attack surface

Reachable over the network through the user processing endpoint with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.766, 99.5th percentile) and public references are tagged Exploit, indicating exploit code is publicly available.

What to do

• Upgrade rConfig to 3.9.7 or later immediately.
• Restrict network access to the rConfig web interface to trusted management networks only.
• Audit existing accounts for unauthorized administrator accounts and remove them.
• Rotate credentials for rConfig and any managed devices it stores.
• Monitor the user processing endpoint for unexpected account creation requests.

Detection

• Alert on POST requests to lib/crud/userprocess.php that create or modify user accounts.
• Review rConfig user tables and logs for new administrator accounts outside change windows.
• Monitor for authentication bypass patterns such as requests reaching admin functions without a prior login.
• Correlate web server logs for access to userprocess.php from untrusted source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.