CVE-2026-77915 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record

Executive Summary

The rConfig network‑device configuration manager (versions 8.0.0‑8.2.12) contains an authentication bypass that lets any Internet‑connected attacker self‑register as a full Administrator. All enterprises that have deployed rConfig in production are exposed to immediate credential theft and unauthorized API token issuance. The executive team must approve emergency patch deployment or network isolation of the affected service within 24 hours.

Verified Facts

• CVE‑2026‑77915 describes an authentication bypass in rConfig 8.0.0 before 8.2.13 — NVD.
• The bypass is caused by a duplicate Auth::routes() call in routes/web.php that re‑enables the POST /register endpoint after it was disabled — NVD.
• Successful registration creates an account that is automatically granted Administrator privileges because the users.role column defaults to Admin — NVD.
• CVSS v3.1 base score is 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — NVD.
• The vulnerability is classified under CWE‑306 (Missing Authentication) and CWE‑1188 (Insecure Default Permissions) — NVD.

Threat Classification

Threat type: authentication‑bypass leading to privilege escalation (Create Account). Affected sectors: any industry that uses rConfig for device configuration, including telecommunications, finance, and manufacturing. Geographic scope: global, because rConfig is distributed worldwide. Exploitation status: no public exploit observed; the vulnerability is theoretically exploitable (MEDIUM CONFIDENCE). Attacker motivation: obtain unrestricted access to stored device credentials and issue API tokens for further lateral movement (HIGH CONFIDENCE).

Threat Severity Assessment

• Exploitability – Network‑reachable, no authentication, low complexity (HIGH CONFIDENCE).
• Impact – Full confidentiality, integrity, and availability compromise of device credentials and API tokens (HIGH CONFIDENCE).
• CVSS score of 9.8 confirms Critical severity (HIGH CONFIDENCE).

Business Impact

Operational disruption: an attacker can register an admin account, extract stored device credentials, and re‑configure critical network equipment, causing immediate service outage. Regulatory liability: exposure of credential data that qualifies as personal data under GDPR or NIS2 may trigger fines up to €20 million or 4 % of global turnover. Financial exposure: loss of revenue from downtime plus incident response costs places the organization in the high‑exposure tier. Reputational damage: public disclosure of a credential breach will erode customer trust and can lead to contract termination.

Technical Analysis

• Attack vector: unauthenticated HTTP POST to /register (network‑level).
• Exploitation chain: duplicate Auth::routes() re‑enables registration → registration controller creates user record → users.role defaults to Admin → attacker receives authenticated admin session.
• Affected component: Laravel routing file routes/web.php and registration controller logic.
• Vulnerable versions: rConfig 8.0.0 up to 8.2.12 (inclusive).
• Root cause: missing authentication check (CWE‑306) combined with insecure default role assignment (CWE‑1188).
• CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

CVE Analysis

• CVE‑2026‑77915 – rConfig 8.0.0‑8.2.12 – Authentication Bypass / Privilege Escalation – Network, No Authentication Required – Patch available in rConfig 8.2.13 (CWE‑306, CWE‑1188).

MITRE ATT&CK Mapping

• Credential Access → T1136.001: Create Account: Local Account — the duplicate route allows creation of a new admin account without credentials.
• Initial Access → T1078: Valid Accounts — the attacker gains a valid admin session immediately after registration.

IOC Intelligence

No public IOCs confirmed at time of publication.

Defenders should build hunt rules for the following behavioral indicators:

• Unauthenticated HTTP POST requests to /register that receive a 200 OK response.
• Database insert events where users.role is set to “Admin” without prior authentication context.
• Successful login events originating from newly created admin accounts within minutes of registration.
• API token issuance events tied to accounts created via the registration endpoint.

Detection Engineering Guidance

• Web server access logs (e.g., Nginx/Apache) – filter for POST /register with status 200 and source IP not present in authentication logs.
• Application logs – monitor for log entries indicating user creation with role=Admin and missing auth context.
• Database audit logs – alert on INSERT statements into the users table where role='Admin' and the session user is “guest”.
• Authentication logs – correlate immediate successful login events for the newly created admin user.
• API gateway logs – flag token generation calls that reference the newly created admin account.

Sigma Rules

title: rConfig Admin Account Creation via Unauthenticated Registration
id: 3f9c2a1e-5d4b-4e9a-9c2f-1a2b3c4d5e6f
status: stable
description: Detects creation of an Administrator account through the POST /register endpoint without prior authentication in rConfig versions < 8.2.13.
author: CYBERDUDEBIVASH Sentinel Apex
logsource:
    product: webserver
    service: nginx
detection:
    selection_register:
        uri: '/register'
        http_method: 'POST'
        status: 200
    selection_no_auth:
        src_user: '-'
    condition: selection_register and selection_no_auth
falsepositives:
    - Legitimate self‑service registration (if enabled)
level: high
tags:
    - attack.t1136.001
    - attack.t1078

Threat Hunting Queries

• Hypothesis: Unauthenticated registration requests are being used to create admin accounts – Source: Web server access logs (uri="/register", http_method="POST", status=200, src_user="-").
• Hypothesis: New admin users appear without prior login – Source: Database audit logs (INSERT into users where role="Admin" and session_user="guest").
• Hypothesis: Immediate admin logins follow registration – Source: Authentication logs (event_id=4624, account_type="Admin", logon_type=2, timestamp within 5 minutes of account creation).
• Hypothesis: API tokens are issued to accounts created via registration – Source: API gateway logs (event="token_issued", account_role="Admin", creation_source="registration_endpoint").
• Hypothesis: External IPs repeatedly hit the registration endpoint – Source: NetFlow/Firewall logs (dst_port=80/443, dst_ip=web_server_ip, dst_port=80/443, uri="/register", count>10 per hour).

SOC Analyst Playbook

• P0 – Verify exploitation: Query web server logs for POST /register 200 responses from unauthenticated sources; if found, isolate the affected host.
• P0 – Capture evidence: Export the corresponding request/response payloads and database INSERT statements for forensic analysis.
• P1 – Block registration endpoint: Deploy a temporary WAF rule to deny POST /register for all external IPs.
• P1 – Patch verification: Confirm that the environment runs rConfig version < 8.2.13; if so, schedule immediate upgrade to 8.2.13.
• P2 – Account remediation: Search for all user records with role=Admin created after the detection window; disable or delete them and force password reset.
• P2 – Notify stakeholders: Escalate to Incident Response lead and prepare regulatory breach notification if credential data was accessed.

Executive Decision Matrix

🔗 Related Intelligence Reports

• Related topic: CVE-2026-76070 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-67602 — CVSS 9.1 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-76840 — CVSS 9.6 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-78211 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-78167 — CVSS 10.0 CRITICAL Severity | NVD Vulnerability Record