PT-2025-38672 · Ruijie · Ruijie 6000-E10

Maximdevere · Published 2025-09-22 · Updated 2025-09-24 · CVE-2025-10774

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ruijie 6000-E10 versions through 2.4.3.6-20171117

Description A weakness exists in Ruijie 6000-E10. The issue affects an unknown part of the file /view/vpn/autovpn/sub commit.php. Manipulation of the key argument can lead to operating system command injection. The attack can be initiated remotely. The exploit has been publicly released. The vendor was contacted regarding this issue but did not respond.

Recommendations Versions through 2.4.3.6-20171117 should be updated. As a temporary workaround, restrict access to the file /view/vpn/autovpn/sub commit.php to minimize the risk of exploitation. Avoid using the key parameter in the affected file until the issue is resolved.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2025-10774

Affected Products

Ruijie 6000-E10

References · 8

• 🔥 https://github.com/maximdevere/CVE2/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10774 · Security Note
• https://vuldb.com/?id.325130 · Note
• https://vuldb.com/?ctiid.325130 · Note
• https://twitter.com/SecAideInfo/status/1970794034328109192 · Twitter Post
• https://vuldb.com/?submit.649968 · Note
• https://twitter.com/CVEnew/status/1969956787697725686 · Twitter Post
• https://t.me/CVEtracker/33020 · Telegram Post