Remote Code Execution Vulnerability in Ruijie RG-EG350 Gateway Management System

CVE-2024-2909

What is CVE-2024-2909?

A severe remote code execution vulnerability exists in the Ruijie RG-EG350 Easy Gateway Management System, specifically in the HTTP POST request handler located at /itbox_pi/networksafe.php?a=set. This vulnerability arises from improper handling of the bandwidth parameter, allowing attackers to inject operating system commands. Exploitation of this vulnerability is possible remotely, posing a significant risk to affected devices. Although the vendor was promptly informed about this issue, there has been no response or patch provided. Organizations using affected versions of the RG-EG350 should prioritize immediate security measures to mitigate potential risks.

References