CVE-2024-46874

CVE-2024-46874 affects Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x. The root causes include a weak MQTT credential mechanism and features that allow an authenticated MQTT client (with device credentials) to publish to topics, view/exfiltrate data, invalidate sessions, and iss...

CVE-2024-46874: Improper Handling of Insufficient Permissions or Privileges

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credentials to send messages to some topics. Attackers with device credentials could issue commands to other devices on behalf of Ruijie's cloud...