CVE-2021-43159

HighCVSS 8.8

Published: 04/05/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.74%

75th percentile - higher than 75% of all known CVEs

Summary

A Remote Code Execution (RCE) vulnerability exists in Ruijie RG-EW Series Routers running ReyeeOS up to version 1.55.1915 / EW_3.0(1)B11P55 via the setSessionTime function in /cgi-bin/luci/api/common. An attacker can send a crafted request to execute arbitrary code on the device.

Risk Assessment

This vulnerability allows an unauthenticated attacker to remotely take control of the router, potentially compromising data confidentiality and integrity in the local network and enabling further attacks on other devices.

Recommendation

Immediately update the router firmware to a version newer than 1.55.1915 / EW_3.0(1)B11P55, or if not available, restrict management interface access to trusted networks only.

Other vulnerabilities in Ruijie RG-EW Series Routers

CVE-2021-43162High
A Remote Code Execution (RCE) vulnerability exists in Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the runPackDiagnose function in /cgi-bin/luci/api/diagnose. An attacker can send a crafted request to execute arbitrary code on the device.

Original NVD description (English source)

A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the setSessionTime function in /cgi-bin/luci/api/common..

Vulnerability data from NVD (NIST) · CISA KEV · EPSS