PT-2024-20280 · Ruijie · Ruijie Rg-Nbs2009G-P Rgos

Zty-1995 · Published 2024-10-02 · Updated 2024-11-13 · CVE-2024-24117

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ruijie RG-NBS2009G-P RGOS version 10.4(1)P2 Release (9736)

Description The issue allows a remote attacker to gain privileges via the login check state component. This is due to an Insecure Permissions vulnerability. A remote attacker can exploit this flaw to gain privileges.

Recommendations For Ruijie RG-NBS2009G-P RGOS version 10.4(1)P2 Release (9736), patch immediately to fix the Insecure Permissions vulnerability in the login check state component and review access controls to minimize the risk of exploitation.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2024-24117

Affected Products

Ruijie Rg-Nbs2009G-P Rgos

References · 8

• 🔥 https://github.com/zty-1995/RG-NBS2009G-P-switch/tree/main/Any%20user%20login%20exists · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-24117 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24117 · Vendor Advisory
• https://twitter.com/oktsec/status/1841744412969251136 · Twitter Post
• https://t.me/cvedetector/6883 · Telegram Post
• https://twitter.com/CVEnew/status/1841579242171011175 · Twitter Post
• https://gist.github.com/zty-1995/dbb3d5b2dbf65b4de5b71e57d08139ea · Note
• https://t.me/cvenotify/101624 · Telegram Post