Vulnerability · Published Dec 15, 2025 · Assigned by VulnCheck
CVE-2023-53881ReyeeOS 1.204.1614 Man-in-the-Middle Remote Code Execution via CWMP
Critical 9.2
In plain English
A critical-severity security flaw in ReyeeOS from Ruijie. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 4.0)9.2Critical
Exploit odds (30 days)0.3%top 76.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ReyeeOS 1.204.1614 contains an unencrypted CWMP communication vulnerability that allows attackers to intercept and manipulate device communication through a man-in-the-middle attack. Attackers can create a fake CWMP server to inject and execute arbitrary commands on Ruijie Reyee Cloud devices by exploiting the unprotected HTTP polling requests.
Affected products (as reported)
Weakness: CWE-319 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- ExploitDB-51642 exploit
- Ruijie Networks Vendor Hompage product
- VulnCheck Advisory: ReyeeOS 1.204.1614 Man-in-the-Middle Remote Code Execution via CWMP third-party-advisory