PT-2024-2959 · Ruijie · Ruijie Rg-Nbr700Gw

Published 2024-03-29 · Updated 2025-06-30 · CVE-2024-28288

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ruijie RG-NBR700GW version 10.3(4b12)

Description The issue is related to a lack of cookie verification when resetting the password, resulting in an administrator password reset vulnerability. An attacker can exploit this to log in to the device and disrupt enterprise business. The vulnerability is associated with deficiencies in the password recovery mechanism, allowing a remote attacker to reset or change passwords without knowing the original password.

Recommendations For Ruijie RG-NBR700GW version 10.3(4b12), consider disabling the password reset feature until a patch is available to prevent exploitation. Restrict access to the device to minimize the risk of unauthorized login and business disruption. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-640

CWE-565

Related Identifiers

BDU:2024-03126

CVE-2024-28288

Affected Products

Ruijie Rg-Nbr700Gw

References · 10

• 🔥❌ https://github.com/adminquit/CVE-2024-28288/blob/d8223c6d45af877669c27fa0a95adfe51924fa86/CVE-2024-28288/CVE-2024-28288.md · Exploit, Deleted
• https://bdu.fstec.ru/vul/2024-03126 · Security Note
• https://safe-surf.ru/upload/VULN-new/VULN.2024-04-12.1.pdf · Security Note
• https://osv.dev/vulnerability/CVE-2024-28288 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28288 · Security Note
• https://t.me/cvenotify/127083 · Telegram Post
• https://vuldb.com/?id.258771 · Note
• https://pan.baidu.com/s/1H4J_eA6wSCnDEsUSAWIzsg?pwd=CVE1 · Note
• https://t.me/cvenotify/100521 · Telegram Post
• https://t.me/cvenotify/75185 · Telegram Post