CVE-2021-43163
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
A Remote Code Execution (RCE) vulnerability exists in Ruijie RG-EW Series Routers running ReyeeOS up to version 1.55.1915 / EW_3.0(1)B11P55. The flaw is located in the checkNet function within /cgi-bin/luci/api/auth.
Risk Assessment
An attacker can remotely execute arbitrary code on the vulnerable device, leading to full compromise of the router and potential network takeover.
Recommendation
Immediately update the router firmware to the latest ReyeeOS version that fixes this vulnerability. If an update is unavailable, restrict management interface access to trusted networks only.
Other vulnerabilities in Ruijie ReyeeOS
See all- CVE-2021-43164High
A Remote Code Execution (RCE) vulnerability exists in Ruijie RG-EW Series Routers running ReyeeOS up to version 1.55.1915 / EW_3.0(1)B11P55 via the updateVersion function in /cgi-bin/luci/api/wireless. An attacker can exploit this flaw to gain unauthorized control over the device.
- CVE-2021-43161High
A Remote Code Execution (RCE) vulnerability exists in Ruijie RG-EW Series Routers running ReyeeOS up to version 1.55.1915 / EW_3.0(1)B11P55 via the doSwitchApi function in /cgi-bin/luci/api/switch. An attacker can send a crafted request to execute arbitrary code on the device.
- CVE-2021-43160High
A Remote Code Execution (RCE) vulnerability exists in Ruijie RG-EW series routers running ReyeeOS up to version 1.55.1915 / EW_3.0(1)B11P55 via the switchFastDhcp function in /cgi-bin/luci/api/diagnose. An attacker can send a crafted request to execute arbitrary code on the device.
Original NVD description (English source)
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the checkNet function in /cgi-bin/luci/api/auth.