PT-2024-21375 · Ruijie · Ruijie Rg-Nbs2009G-P Rgos

H0E4A0R1T · Published 2024-03-19 · Updated 2025-08-21 · CVE-2024-2641

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ruijie RG-NBS2009G-P up to 20240305

Description A critical issue has been found in the Password Handler component of the Ruijie RG-NBS2009G-P, specifically in the /system/passwdManage.htm file. This issue leads to improper authorization and can be exploited remotely. The vendor was contacted about this disclosure but did not respond.

Recommendations For Ruijie RG-NBS2009G-P up to 20240305, as a temporary workaround, consider restricting access to the /system/passwdManage.htm file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2024-2641

Affected Products

Ruijie Rg-Nbs2009G-P Rgos

References · 8

• 🔥 https://h0e4a0r1t.github.io/2024/vulns/Unauthorized%20access%20vulnerability%20in%20Ruijie%20RG-NBS2009G-P%20switch.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-2641 · Security Note
• https://vuldb.com/?ctiid.257280 · Note
• https://twitter.com/CVEnew/status/1770191662481895787 · Twitter Post
• https://t.me/cveNotify/133009 · Telegram Post
• https://vuldb.com/?id.257280 · Note
• https://twitter.com/VulmonFeeds/status/1770217416452088170 · Twitter Post
• https://twitter.com/oktsec/status/1770292352092946687 · Twitter Post