PT-2025-47958 · Ruijie · Ruijie Nbr Series Routers

Published 2025-11-24 · Updated 2025-11-25 · CVE-2023-7330

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ruijie NBR series routers (affected versions not specified)

Description Ruijie NBR series routers contain an unauthenticated arbitrary file upload issue via the /ddi/server/fileupload.php endpoint. The endpoint accepts attacker-controlled values in the name and uploadDir parameters and saves the provided file content without sufficient validation. This allows a remote attacker to upload a crafted PHP file and then access it from the web root, potentially leading to arbitrary code execution within the web service context. The Shadowserver Foundation observed exploitation of this issue on January 14, 2025 UTC.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-7330

Affected Products

Ruijie Nbr Series Routers

References · 11

• 🔥 https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/ruijie/ruijie-nbr-fileupload.yaml · Exploit
• 🔥 https://rfk0z.github.io/posts/Ruijie-NBR-router-fileupload-php-arbitrary-file-upload-vulnerability · Exploit
• 🔥 https://cnblogs.com/Domren/articles/19093295 · Exploit
• 🔥 https://cn-sec.com/archives/1995366.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-7330 · Security Note
• https://osv.dev/vulnerability/CVE-2023-7330 · Vendor Advisory
• https://twitter.com/CVEnew/status/1993057413075816474 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1993158675716776077 · Twitter Post
• https://t.me/CVEtracker/38116 · Telegram Post
• https://vulncheck.com/advisories/ruijie-networks-nbr-routers-unauthenticated-arbitrary-file-upload-via-fileuploadphp · Note
• https://twitter.com/0dayPublishing/status/1993057055280644250 · Twitter Post