PT-2024-2343 · Ruijie · Ruijie Rg-Nbs2009G-P Rgos+1

H0E4A0R1T · Published 2024-03-19 · Updated 2025-08-21 · CVE-2024-2642

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ruijie RG-NBS2009G-P versions up to 20240305 Ruijie Reyee series RG-ES200 (affected versions not specified)

Description A critical vulnerability has been found, allowing for command injection through the manipulation of the Command1 argument in an unknown functionality of the file /EXCU SHELL. This can be exploited remotely. The issue is related to the failure to neutralize special elements used in the OS command, potentially allowing an attacker to execute arbitrary code.

Recommendations For Ruijie RG-NBS2009G-P versions up to 20240305, consider disabling the unknown functionality of the file /EXCU SHELL to prevent command injection until a patch is available. For Ruijie Reyee series RG-ES200, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-02291

CVE-2024-2642

Affected Products

Ruijie Rg-Nbs2009G-P Rgos

Ruijie Reyee Series Rg-Es200

References · 8

• 🔥 https://h0e4a0r1t.github.io/2024/vulns/Ruijie%20RG-NBS2009G-P%20switch%20has%20a%20foreground%20CLI%20command%20injection%20vulnerability.pdf · Exploit
• https://bdu.fstec.ru/vul/2024-02291 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-2642 · Security Note
• https://vuldb.com/?id.257281 · Note
• https://twitter.com/VulmonFeeds/status/1770246855089115198 · Twitter Post
• https://t.me/cveNotify/133010 · Telegram Post
• https://vuldb.com/?ctiid.257281 · Note
• https://twitter.com/CVEnew/status/1770202992287133872 · Twitter Post