PT-2025-45510 · Ruijie · Ruijie Nbr+1

Published 2025-11-07 · Updated 2025-11-10 · CVE-2020-36870

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ruijie Gateway EG and NBR models versions 11.1(6)B9P1 through 11.9(4)B12P1

Description The EWEB management system in various Ruijie Gateway EG and NBR models contains a code execution issue. Attackers can exploit front-end code when features like guest authentication, local server authentication, or screen mirroring are enabled, potentially gaining access or executing commands on affected devices. The Shadowserver Foundation first observed exploitation evidence on 2025-06-07 UTC. The vulnerability is exploitable with zero authentication through guest authentication features.

Recommendations Versions 11.1(6)B9P1 through 11.9(4)B12P1 should be updated.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-36870

Affected Products

Ruijie Gateway Eg

Ruijie Nbr

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2020-36870 · Security Note
• https://vulncheck.com/advisories/ruijie-networks-eg-and-nbr-series-routers-rce · Note
• https://twitter.com/CVEnew/status/1986920309325504908 · Twitter Post
• https://cnvd.org.cn/flaw/show/CNVD-2021-09650 · Note
• https://twitter.com/CCBalert/status/1987906152307286364 · Twitter Post
• https://ruijie.com.cn/gy/xw-aqtg-zw/85638 · Patch, Vendor Advisory
• https://ruijie.com.cn/gy/xw-aqtg-gw/86747 · Patch, Vendor Advisory
• https://t.me/CVEtracker/36813 · Telegram Post
• https://twitter.com/0dayPublishing/status/1986919010093482210 · Twitter Post