CVE-2023-34644
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
The vulnerability allows remote code execution in Ruijie Networks products, such as RG-EW home routers, RG-NBS and RG-S1930 switches, RG-EG VPN routers, and EAP and RAP access points. Attackers can gain the highest privileges via a crafted POST request to /cgi-bin/luci/api/auth.
Risk Assessment
This threat allows unauthorized attackers to take control of devices, potentially leading to serious security breaches within the organization's network.
Recommendation
It is recommended to update the device firmware to the latest versions that mitigate this vulnerability and to monitor logs for potential attack attempts.
Original NVD description (English source)
Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW_3.0(1)B11P204, RG-NBS and RG-S1930 series switches SWITCH_3.0(1)B11P218, RG-EG series business VPN routers EG_3.0(1)B11P216, EAP and RAP series wireless access points AP_3.0(1)B11P218, NBC series wireless controllers AC_3.0(1)B11P86 allows unauthorized remote attackers to gain the highest privileges via crafted POST request to /cgi-bin/luci/api/auth.