According to external reports, a command injection vulnerability exists on the Eweb management system of some Ruijie products. The details are as follows:

1. 1.Description

Certain Eweb management systems are susceptible to remote code injection attacks. This allows unauthorized attackers to exploit this vulnerability to gain control over the device.

2. 2.Source

This vulnerability was discovered in the test by Wang Jincheng from the X1cT34m team of Nanjing University of Posts and Telecommunications. Ruijie expresses gratitude for the attention of Wang Jincheng paid to Ruijie product security.

3. 3.Affected Products and Versions

Involved product models and software versions include:

Model	Software Version
Reyee NBS3/5/6/7 Series	SWITCH_3.0(1)B11P219 and earlier versions, excluding R219.
Reyee EG Series	EG_3.0(1)B11P219 and earlier versions, excluding R219.
Reyee EAP/RAP/NBC Series	AP_3.0(1)B11P219 and earlier versions, excluding R219.
Reyee EW Series	EW_3.0(1)B11P219 and earlier versions, excluding R219.

4. 4.Vulnerability Level

Vulnerabilities are scored base on the CVSS v3.1 scoring system. For details, see: https://www.first.org/cvss/v3.1/specification-document

CVSS3.1 base score: 9.8
CVSS v3.1 Vector: AV:AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

5. 5.Workaround

N/A

6. 6.Solution

Model	Software Version	Description
See Model in the Affected Products and Versions.	https://www.ruijienetworks.com/resources/products/?activeName=software	The latest version has been released on Ruijie Cloud and the official website. Please upgrade promptly.

7. 7.Follow-up Improvement Plan

Ruijie is always customer-centric and protects the ultimate interests of users with best efforts. Ruijie adheres to the responsible disclosure of security incidents and handles product security issues through the product security incident response mechanism. Customers can access Ruijie product security information by visiting the Ruijie PSIRT website or promptly provide security information feedback through the following website: https://www.ruijienetworks.com/support/securityBulletins.

Ruijie will continue to monitor this vulnerability, and relevant investigations are still ongoing. If there is any progress, this security advisory will be updated at the first opportunity. Please pay attention to updates.

You can contact us through the following channels:

Support：https://www.ruijienetworks.com/support

Live Chat（English）：https://networks.s5.udesk.cn/im_client/?web_plugin_id=1296&language=en-us

Live Chat（Español）：https://networks.s5.udesk.cn/im_client/?web_plugin_id=1575&language=es

Community：https://community.ruijienetworks.com/portal.php

Hotline：

 

To report a security vulnerability in Ruijie products and solutions, please send it to PSIRT@ruijie.com.cn.

 

 

 

Ruijie Networks Co., Ltd.

May 22, 2023