Lucene search

VulDBCVE-2024-8166

HistoryAug 26, 2024 - 3:15 p.m.

CVE-2024-8166

2024-08-2615:15:09

CWE-434

VulDB

web.nvd.nist.gov

vulnerability

ruijie eg2000k

remote

unrestricted upload

file manipulation

public disclosure

vendor negligence

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:M/C:P/I:P/A:P

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CVSS4

5.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/SC:N/VI:L/SI:N/VA:L/SA:N

AI Score

4.9

Confidence

High

EPSS

0.002

Percentile

53.6%

JSON

A vulnerability has been found in Ruijie EG2000K 11.1(6)B2 and classified as critical. This vulnerability affects unknown code of the file /tool/index.php?c=download&a=save. The manipulation of the argument content leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected configurations

Nvd

Node

ruijieeg2000k_firmwareMatch11.1\(6\)b2

AND

ruijieeg2000kMatch-

VendorProductVersionCPE
ruijieeg2000k_firmware11.1(6)b2cpe:2.3:o:ruijie:eg2000k_firmware:11.1\(6\)b2:*:*:*:*:*:*:*
ruijieeg2000k-cpe:2.3:h:ruijie:eg2000k:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ruijie	eg2000k_firmware	11.1(6)b2	cpe:2.3:o:ruijie:eg2000k_firmware:11.1\(6\)b2:::::::*
ruijie	eg2000k	-	cpe:2.3:h:ruijie:eg2000k:-:::::::*

CNA Affected

[
  {
    "vendor": "Ruijie",
    "product": "EG2000K",
    "versions": [
      {
        "version": "11.1(6)B2",
        "status": "affected"
      }
    ]
  }
]

References

github.com/qiuhuihk/cve/blob/main/ruijie.md

vuldb.com/?ctiid.275764

vuldb.com/?id.275764

vuldb.com/?submit.393750

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:M/C:P/I:P/A:P

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CVSS4

5.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/SC:N/VI:L/SI:N/VA:L/SA:N

AI Score

4.9

Confidence

High

EPSS

0.002

Percentile

53.6%

JSON

Related for CVE-2024-8166