CVE-2024-24116
📋 TL;DR
A privilege escalation vulnerability in Ruijie RG-NBS2009G-P switches allows remote attackers to gain administrative access via the system/config_menu.htm endpoint. This affects organizations using these switches with the vulnerable RGOS firmware version. Attackers can exploit this without authentication to take full control of the network device.
💻 Affected Systems
- Ruijie RG-NBS2009G-P
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of network switch allowing attacker to reconfigure network, intercept traffic, disable security controls, and pivot to other systems.
Likely Case
Unauthorized administrative access leading to network disruption, data interception, and potential lateral movement within the network.
If Mitigated
Limited impact if network segmentation isolates management interfaces and strict access controls are enforced.
🎯 Exploit Status
Public proof-of-concept available on GitHub demonstrates exploitation via HTTP request to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Check Ruijie official website for security advisories and firmware updates. No official patch information available at this time.
🔧 Temporary Workarounds
Restrict Management Interface Access
allBlock access to the vulnerable endpoint and restrict management interfaces to trusted IPs only.
access-list 100 deny tcp any any eq 80
access-list 100 deny tcp any any eq 443
access-list 100 permit ip any any
interface vlan 1
ip access-group 100 in
Disable HTTP/HTTPS Management
allDisable web management interface and use CLI/SSH only.
no ip http server
no ip http secure-server
🧯 If You Can't Patch
- Isolate switch management VLAN from user networks
- Implement strict network segmentation and firewall rules to limit access to management interfaces
🔍 How to Verify
Check if Vulnerable:
Check if system/config_menu.htm endpoint is accessible without authentication via HTTP/HTTPS.Check Version:
show versionVerify Fix Applied:
Verify that system/config_menu.htm endpoint requires authentication or returns 404/403.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to system/config_menu.htm
- Unexpected configuration changes
- New administrative sessions from unusual IPs
Network Indicators:
- HTTP requests to /system/config_menu.htm from unauthorized sources
- Unusual management traffic patterns
SIEM Query:
source="switch_logs" AND (uri="/system/config_menu.htm" OR event="configuration change")