CVE-2021-43160
📋 TL;DR
A remote code execution vulnerability in Ruijie Networks RG-EW Series Routers allows attackers to execute arbitrary commands via the switchFastDhcp function in the web interface. This affects routers running ReyeeOS up to version 1.55.1915 / EW_3.0(1)B11P55. Attackers can potentially gain full control of affected devices.
💻 Affected Systems
- Ruijie Networks RG-EW Series Routers
📦 What is this software?
Reyeeos by Ruijienetworks
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router allowing attacker to intercept all network traffic, deploy malware to connected devices, pivot to internal networks, and maintain persistent access.
Likely Case
Router compromise leading to network disruption, credential theft, and deployment of additional attacks against internal systems.
If Mitigated
Limited impact if device is behind firewall with restricted web interface access and proper network segmentation.
🎯 Exploit Status
Exploit details publicly disclosed in Full Disclosure mailing list. Attack requires network access to web interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after ReyeeOS 1.55.1915 / EW_3.0(1)B11P55
Vendor Advisory: http://ruijie.com
Restart Required: Yes
Instructions:
1. Check current firmware version. 2. Download latest firmware from Ruijie support portal. 3. Backup configuration. 4. Upload and apply firmware update. 5. Verify update completed successfully.
🔧 Temporary Workarounds
Disable Web Management Interface
allDisable the web management interface if not required for operations.
Configure via CLI: no web-management enable
Restrict Web Interface Access
allLimit access to web management interface to trusted IP addresses only.
Configure via CLI: ip http access-class <ACL-NUMBER>
🧯 If You Can't Patch
- Place router behind firewall with strict inbound rules blocking all unnecessary ports
- Implement network segmentation to isolate router from critical systems
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or CLI command: show versionCheck Version:
show versionVerify Fix Applied:
Verify firmware version is above ReyeeOS 1.55.1915 / EW_3.0(1)B11P55📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /cgi-bin/luci/api/diagnose
- Unexpected process execution or configuration changes
Network Indicators:
- Unusual outbound connections from router
- Traffic patterns indicating command and control
SIEM Query:
source="router_logs" AND uri="/cgi-bin/luci/api/diagnose" AND method="POST"