CVE-2024-8166

A vulnerability has been found in Ruijie EG2000K 11.1(6)B2 and classified as critical. This vulnerability affects unknown code of the file /tool/index.php?c=download&a=save. The manipulation of the argument content leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
References
Link Resource
https://github.com/qiuhuihk/cve/blob/main/ruijie.md Exploit Third Party Advisory
https://vuldb.com/?ctiid.275764 Permissions Required
https://vuldb.com/?id.275764 Third Party Advisory VDB Entry
https://vuldb.com/?submit.393750 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:ruijie:eg2000k_firmware:11.1\(6\)b2:*:*:*:*:*:*:*
cpe:2.3:h:ruijie:eg2000k:-:*:*:*:*:*:*:*

History

27 Aug 2024, 13:03

Type Values Removed Values Added
First Time Ruijie
Ruijie eg2000k
Ruijie eg2000k Firmware
Summary
  • (es) Una vulnerabilidad ha sido encontrada en Ruijie EG2000K 11.1(6)B2 y clasificada como crítica. Esta vulnerabilidad afecta a código desconocido del archivo /tool/index.php?c=download&a=save. La manipulación del contenido del argumento conduce a una carga sin restricciones. El ataque se puede iniciar de forma remota. El exploit ha sido divulgado al público y puede utilizarse. NOTA: Se contactó primeramente con el proveedor sobre esta divulgación, pero no respondió de ninguna manera.
CPE cpe:2.3:o:ruijienetworks:eg2000k_firmware:11.1\(6\)b2:*:*:*:*:*:*:*
cpe:2.3:h:ruijienetworks:eg2000k:-:*:*:*:*:*:*:*
cpe:2.3:h:ruijie:eg2000k:-:*:*:*:*:*:*:*
cpe:2.3:o:ruijie:eg2000k_firmware:11.1\(6\)b2:*:*:*:*:*:*:*

26 Aug 2024, 18:55

Type Values Removed Values Added
CVSS v2 : 5.8
v3 : 4.7
v2 : 5.8
v3 : 4.9
First Time Ruijienetworks
Ruijienetworks eg2000k Firmware
Ruijienetworks eg2000k
CPE cpe:2.3:o:ruijienetworks:eg2000k_firmware:11.1\(6\)b2:*:*:*:*:*:*:*
cpe:2.3:h:ruijienetworks:eg2000k:-:*:*:*:*:*:*:*
References () https://github.com/qiuhuihk/cve/blob/main/ruijie.md - () https://github.com/qiuhuihk/cve/blob/main/ruijie.md - Exploit, Third Party Advisory
References () https://vuldb.com/?ctiid.275764 - () https://vuldb.com/?ctiid.275764 - Permissions Required
References () https://vuldb.com/?id.275764 - () https://vuldb.com/?id.275764 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.393750 - () https://vuldb.com/?submit.393750 - Third Party Advisory, VDB Entry

26 Aug 2024, 15:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-08-26 15:15

Updated : 2024-08-27 13:03


NVD link : CVE-2024-8166

Mitre link : CVE-2024-8166

CVE.ORG link : CVE-2024-8166


JSON object : View

Products Affected

ruijie

  • eg2000k
  • eg2000k_firmware
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type