CVE-2020-9425

CVE-2020-9425 is a high-severity information disclosure vulnerability affecting rConfig versions prior to 3.9.4. An unauthenticated attacker can retrieve cleartext credentials by sending a GET request to settings.php. This occurs because the application fails to exit after a redirect, leading to the disclosure of sensitive data in the response. The vulnerability has a CVSS score of 7.5 and an EPSS score indicating a higher likelihood of exploitation compared to most CVEs. While there is no evidence of active exploitation or Metasploit modules, Nuclei templates exist for detecting this flaw, and it has received minimal community discussion or media coverage.