CVE-2021-43162
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Ruijie Networks RG-EW Series Routers by exploiting improper input validation in the runPackDiagnose function. Attackers can gain full control of affected routers without authentication. Organizations using Ruijie RG-EW routers with vulnerable firmware versions are affected.
💻 Affected Systems
- Ruijie Networks Ruijie RG-EW Series Routers
📦 What is this software?
Reyeeos by Ruijienetworks
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attackers to intercept network traffic, pivot to internal networks, deploy ransomware, or establish persistent backdoors.
Likely Case
Router takeover leading to network disruption, credential theft, and lateral movement within the organization's network.
If Mitigated
Limited impact if routers are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Exploit details and proof-of-concept code are publicly available in security advisories. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after ReyeeOS 1.55.1915 / EW_3.0(1)B11P55
Vendor Advisory: http://ruijie.com
Restart Required: Yes
Instructions:
1. Check current firmware version. 2. Download latest firmware from Ruijie support portal. 3. Upload firmware via web interface. 4. Apply update. 5. Reboot router.
🔧 Temporary Workarounds
Block CGI endpoint access
linuxRestrict access to the vulnerable /cgi-bin/luci/api/diagnose endpoint using firewall rules or web application firewall.
iptables -A INPUT -p tcp --dport 80 -m string --string "/cgi-bin/luci/api/diagnose" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "/cgi-bin/luci/api/diagnose" --algo bm -j DROP
Disable web management interface
allTemporarily disable the router's web management interface if not required for operations.
🧯 If You Can't Patch
- Isolate affected routers in separate VLAN with strict network segmentation
- Implement strict inbound firewall rules blocking all external access to router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or CLI. If version is ReyeeOS 1.55.1915 or earlier, or EW_3.0(1)B11P55 or earlier, system is vulnerable.Check Version:
ssh admin@router-ip show version | grep FirmwareVerify Fix Applied:
Verify firmware version is updated beyond vulnerable versions. Test if /cgi-bin/luci/api/diagnose endpoint returns error or is inaccessible.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /cgi-bin/luci/api/diagnose
- Suspicious command execution in system logs
- Unexpected process creation
Network Indicators:
- Unusual outbound connections from router
- Traffic spikes from router management interface
- Unexpected SSH/RDP connections originating from router
SIEM Query:
source="router_logs" AND (uri="/cgi-bin/luci/api/diagnose" OR process="runPackDiagnose")