Ruijie Reyee OS (Update A)
Successful exploitation of this vulnerabilities could allow attackers to take near full control over the device.
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-52324US | critical9.8 | — | ||
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in d… | ||||
| CVE-2024-48874US | critical9.8 | — | ||
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's proxy servers to perform any request the attackers choose. Using… | ||||
| CVE-2024-47791US | medium5.3 | — | ||
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to subscribe to partial possible topics in Ruijie MQTT broker, and receive partial messages… | ||||
| CVE-2024-47146US | medium6.5 | — | ||
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to obtain the devices serial number if physically adjacent and sniffing the RAW WIFI signal… | ||||
| CVE-2024-46874US | critical9.9 | — | ||
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credentials to send messages to some topics. Attackers with device… | ||||
| CVE-2024-45722US | high7.5 | — | ||
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses weak credential mechanism that could allow an attacker to easily calculate MQTT credentials. | ||||
| CVE-2024-51727US | high7.5 | — | ||
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a feature that could enable attackers to invalidate a legitimate user's session and cause a denial-of-serv… | ||||
| CVE-2024-47547US | critical9.8 | — | ||
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which leaves authentication vulnerable to brute f… | ||||
| CVE-2024-47043US | medium5.3 | — | ||
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could enable an attacker to correlate a device serial number and the user's phone number and part of the email addr… | ||||
| CVE-2024-42494US | high7.5 | — | ||
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a a feature that could enable sub accounts or attackers to view and exfiltrate sensitive information from… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-24-338-01 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-24-338-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (10)
- MitigationReyee OS
Ruijie reports that the issues have been fixed on the cloud and no action is needed by end users.
- MitigationReyee OS
Ruijie reports that the issues have been fixed on the cloud and no action is needed by end users.
- MitigationReyee OS
Ruijie reports that the issues have been fixed on the cloud and no action is needed by end users.
- MitigationReyee OS
Ruijie reports that the issues have been fixed on the cloud and no action is needed by end users.
- MitigationReyee OS
Ruijie reports that the issues have been fixed on the cloud and no action is needed by end users.
- MitigationReyee OS
Ruijie reports that the issues have been fixed on the cloud and no action is needed by end users.
- MitigationReyee OS
Ruijie reports that the issues have been fixed on the cloud and no action is needed by end users.
- MitigationReyee OS
Ruijie reports that the issues have been fixed on the cloud and no action is needed by end users.
- MitigationReyee OS
Ruijie reports that the issues have been fixed on the cloud and no action is needed by end users.
- MitigationReyee OS
Ruijie reports that the issues have been fixed on the cloud and no action is needed by end users.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan