Remote Code Execution Vulnerability in Ruijie Networks Home Routers and Switches

CVE-2023-34644

Summary

A remote code execution vulnerability exists in various Ruijie Networks devices, allowing unauthorized attackers to execute arbitrary code with elevated privileges. By sending a specially crafted POST request to the vulnerable endpoint /cgi-bin/luci/api/auth, an attacker can exploit this weakness to compromise affected devices, including RG-EW series home routers and RG-NBS series switches, among others. This security flaw poses a significant risk if left unaddressed, potentially leading to unauthorized access and control over critical network infrastructure.

References