Lucene search

[email protected]CVE-2024-2909

HistoryMar 26, 2024 - 9:15 p.m.

CVE-2024-2909

2024-03-2621:15:53

CWE-78

[email protected]

web.nvd.nist.gov

ruijie rg-eg350

critical vulnerability

http post request handler

os command injection

remote attack

disclosure

nvd

public exploit

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

Low

9 High

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.0005 Low

EPSS

Percentile

16.3%

JSON

A vulnerability classified as critical was found in Ruijie RG-EG350 up to 20240318. Affected by this vulnerability is the function setAction of the file /itbox_pi/networksafe.php?a=set of the component HTTP POST Request Handler. The manipulation of the argument bandwidth leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257977 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected configurations

Vulners

Node

ruijierg-uacMatch20240318

VendorProductVersionCPE
ruijierg\-uac20240318cpe:2.3:h:ruijie:rg\-uac:20240318:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ruijie	rg\-uac	20240318	cpe:2.3:h:ruijie:rg\-uac:20240318:::::::*

CNA Affected

[
  {
    "vendor": "Ruijie",
    "product": "RG-EG350",
    "versions": [
      {
        "version": "20240318",
        "status": "affected"
      }
    ],
    "modules": [
      "HTTP POST Request Handler"
    ]
  }
]

References

h0e4a0r1t.github.io/2024/vulns/Ruijie%20EG350%20Easy%20Gateway%20Management%20System%20Exists%20Remote%20Code%20Execution%20Vulnerability%20networksafe.php.pdf

vuldb.com/?ctiid.257977

vuldb.com/?id.257977

vuldb.com/?submit.300368

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

Low

9 High

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.0005 Low

EPSS

Percentile

16.3%

JSON

Related for CVE-2024-2909

cvelist1 nvd1