PT-2025-38672 · Ruijie · Ruijie 6000-E10

Maximdevere · Publicado 2025-09-22 · Atualizado 2025-09-24 · CVE-2025-10774

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ruijie 6000-E10 versions through 2.4.3.6-20171117

Description A weakness exists in Ruijie 6000-E10. The issue affects an unknown part of the file /view/vpn/autovpn/sub commit.php. Manipulation of the key argument can lead to operating system command injection. The attack can be initiated remotely. The exploit has been publicly released. The vendor was contacted regarding this issue but did not respond.

Recommendations Versions through 2.4.3.6-20171117 should be updated. As a temporary workaround, restrict access to the file /view/vpn/autovpn/sub commit.php to minimize the risk of exploitation. Avoid using the key parameter in the affected file until the issue is resolved.

Exploit

Correção

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

CVE-2025-10774

Produtos afetados

Ruijie 6000-E10

Referências · 8

• 🔥 https://github.com/maximdevere/CVE2/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10774 · Nota de Segurança
• https://vuldb.com/?id.325130 · Nota
• https://vuldb.com/?ctiid.325130 · Nota
• https://twitter.com/SecAideInfo/status/1970794034328109192 · Publicação no Twitter
• https://vuldb.com/?submit.649968 · Nota
• https://twitter.com/CVEnew/status/1969956787697725686 · Publicação no Twitter
• https://t.me/CVEtracker/33020 · Publicação no Telegram