Unrestricted File Upload Vulnerability in Ruijie EG2000K Products

CVE-2024-8166

What is CVE-2024-8166?

A serious vulnerability exists in Ruijie EG2000K 11.1(6)B2 that allows remote attackers to exploit the /tool/index.php?c=download&a=save endpoint. This threat stems from improper handling of the 'content' argument, which leads to unrestricted file uploads. Attackers can potentially upload malicious files, jeopardizing the integrity and security of the affected system. Despite early disclosure to Ruijie Networks, there has been no response, raising concerns about the urgency of addressing this exploit. Organizations using this product should prioritize mitigation strategies to safeguard their systems.

References