A critical authentication bypass in rConfig allows unauthenticated attackers to register themselves as Administrators, leading to full system control.

This vulnerability involves missing authentication for a critical function (CWE-306) and insecure default initialization (CWE-1188). A duplicate route definition in the application unintentionally re-enables the registration endpoint, and the system fails to assign a restricted role to new users by default, granting them Administrative access.

By bypassing authentication, an attacker can gain full administrative control over the rConfig platform. This allows them to steal device credentials, access sensitive user data, and issue API tokens, resulting in a complete breach of network infrastructure managed by the application. The CVSS score of 9.8 reflects the high risk of total administrative takeover.

Immediate Action: Update rConfig to version 8.2.10 or later to remove the unauthorized registration route and secure user role assignment.

Proactive Monitoring: Review existing user accounts within the rConfig dashboard for any unauthorized or unknown administrative profiles created recently.

Compensating Controls: If patching is delayed, disable public access to the registration page or implement network-level access controls to restrict access to the application interface.

Public Exploit Available: No (exploit_available: false)

Administrators must verify the integrity of their user database immediately and apply the patch. This is a critical security failure that allows an attacker to bypass all authentication controls, making immediate remediation the highest priority.