CVE-2021-43162

HighCVSS 8.8

Published: 04/05/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.62%

73th percentile - higher than 73% of all known CVEs

Summary

A Remote Code Execution (RCE) vulnerability exists in Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the runPackDiagnose function in /cgi-bin/luci/api/diagnose. An attacker can send a crafted request to execute arbitrary code on the device.

Risk Assessment

The risk for the organization is the potential for an unauthorized attacker to take control of the router, leading to a breach of network and data confidentiality and integrity.

Recommendation

It is recommended to immediately update the firmware of Ruijie RG-EW routers to a version later than 1.55.1915 / EW_3.0(1)B11P55 and restrict access to the management interface to trusted IP addresses only.

Other vulnerabilities in Ruijie RG-EW Series Routers

CVE-2021-43159High
A Remote Code Execution (RCE) vulnerability exists in Ruijie RG-EW Series Routers running ReyeeOS up to version 1.55.1915 / EW_3.0(1)B11P55 via the setSessionTime function in /cgi-bin/luci/api/common. An attacker can send a crafted request to execute arbitrary code on the device.

Original NVD description (English source)

A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the runPackDiagnose function in /cgi-bin/luci/api/diagnose.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS