rConfig EUVD-2026-64955

The only prerequisite is network reachability to the rConfig web application's POST /register endpoint on an affected version (8.0.0 before the fix). No authentication, credentials, user interaction, or non-default configuration is required - the vulnerable duplicate Auth::routes() call and the Admin-default role are present in the shipped code, so default installations are exploitable. The primary limiting factor is exposure: instances restricted to an internal management VLAN or placed behind an authenticating reverse proxy/VPN are only reachable by attackers who already hold that network foothold, materially reducing real-world exposure compared to internet-facing deployments.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scoring 9.3 is consistent with the description: network-reachable, no authentication, no user interaction, no special preconditions, and full confidentiality/integrity/availability impact on the application. Unlike many high-CVSS issues that require chained conditions, this is a single unauthenticated HTTP POST against a default code path, so real exploitability closely matches the paper score. There is no CISA KEV listing and no EPSS score provided, and no public exploit code was identified - meaning exploitation is not confirmed in the wild, but the trivial nature and the sensitivity of the target (stored network device credentials) make this a genuine high priority rather than a theoretical one. Note a data discrepancy to verify: the description states the fix is 8.2.13, while the provided release reference anchors to a core 8.2.10 release - confirm the exact patched version with the vendor advisory before remediation.

An attacker who can reach the rConfig web interface sends a single crafted POST /register request with a chosen username and password, receives an account that is immediately authenticated at Admin level, and logs into the console. From there they browse stored device configurations and credentials, issue API tokens, and pivot into the managed network infrastructure. No POC is publicly identified at this time, but the attack requires only an HTTP client and low complexity.