CVE-2021-43163
📋 TL;DR
This vulnerability allows unauthenticated remote attackers to execute arbitrary code on Ruijie Networks RG-EW series routers via the checkNet function in the web interface. It affects organizations using these routers with vulnerable firmware versions, potentially exposing network infrastructure to complete compromise.
💻 Affected Systems
- Ruijie Networks RG-EW Series Routers
📦 What is this software?
Reyeeos by Ruijienetworks
⚠️ Risk & Real-World Impact
Worst Case
Complete router takeover allowing attacker to intercept all network traffic, pivot to internal networks, install persistent backdoors, or use the router as a botnet node.
Likely Case
Router compromise leading to network disruption, credential theft, or deployment of malware for further attacks.
If Mitigated
Limited impact if routers are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Exploit details and proof-of-concept code are publicly available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after ReyeeOS 1.55.1915 / EW_3.0(1)B11P55
Vendor Advisory: http://ruijie.com
Restart Required: Yes
Instructions:
1. Check current firmware version. 2. Download latest firmware from Ruijie support portal. 3. Backup configuration. 4. Upload and apply firmware update via web interface or CLI. 5. Reboot router.
🔧 Temporary Workarounds
Disable Web Management Interface
allDisable the vulnerable web interface to prevent exploitation.
configure terminal
no ip http server
no ip http secure-server
end
write memory
Restrict Management Access
allLimit web interface access to trusted IP addresses only.
configure terminal
ip http access-class TRUSTED_ACL
end
write memory
🧯 If You Can't Patch
- Segment routers into isolated management network with strict access controls
- Implement network monitoring for suspicious traffic to/from router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (System Status > Version) or CLI command 'show version' and compare to vulnerable versions.Check Version:
show versionVerify Fix Applied:
Verify firmware version is above ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 and test that checkNet function no longer accepts malicious input.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /cgi-bin/luci/api/auth
- Multiple failed authentication attempts followed by successful checkNet requests
- System logs showing unexpected process execution
Network Indicators:
- Unusual outbound connections from router to external IPs
- Traffic patterns suggesting router is being used as proxy
- Unexpected ports open on router
SIEM Query:
source="router_logs" AND (uri="/cgi-bin/luci/api/auth" OR process="checkNet")