Vulnerability · Published Aug 26, 2024 · Assigned by VulDB

CVE-2024-8166Ruijie EG2000K index.php unrestricted upload

Medium 4.7

In plain English

A medium-severity unrestricted file upload in EG2000K from Ruijie. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.7%top 47.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in Ruijie EG2000K 11.1(6)B2 and classified as critical. This vulnerability affects unknown code of the file /tool/index.php?c=download&a=save. The manipulation of the argument content leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Ruijie	EG2000K	11.1(6)B2

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

References

VDB-275764 | Ruijie EG2000K index.php unrestricted upload vdb-entry, technical-description
VDB-275764 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #393750 | Ruijie EG2000K EG2000K 11.1(6)B2 Write any file third-party-advisory
https://github.com/qiuhuihk/cve/blob/main/ruijie.md exploit