CVE-2024-24117
📋 TL;DR
This CVE describes an insecure permissions vulnerability in Ruijie RG-NBS2009G-P switches running RGOS v10.4(1)P2 Release (9736). It allows remote attackers to bypass authentication and gain administrative privileges via the login check state component. Organizations using these specific switch models and firmware versions are affected.
💻 Affected Systems
- Ruijie RG-NBS2009G-P switch
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full network compromise: attacker gains administrative access to switch, can reconfigure network, intercept traffic, disable security controls, and pivot to other systems.
Likely Case
Unauthorized administrative access to network switch leading to network disruption, traffic monitoring, and potential lateral movement.
If Mitigated
Limited impact if network segmentation isolates switches and strong access controls prevent external access.
🎯 Exploit Status
Public GitHub repositories contain proof-of-concept code demonstrating the vulnerability. Exploitation appears straightforward based on available information.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Contact Ruijie support for patch availability. 2. If patch exists, download from official vendor portal. 3. Apply firmware update following vendor documentation. 4. Verify successful update.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to switch management interfaces to trusted IP addresses only
access-list 10 permit 192.168.1.0 0.0.0.255
line vty 0 4
access-class 10 in
Management Interface Isolation
allMove management interfaces to separate VLAN with strict access controls
vlan 100
name MANAGEMENT
interface vlan 100
ip address 10.0.100.1 255.255.255.0
🧯 If You Can't Patch
- Isolate affected switches from internet and untrusted networks
- Implement strict network segmentation and monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check switch model and firmware version: show version | include RG-NBS2009G-P and VersionCheck Version:
show versionVerify Fix Applied:
Verify firmware version is updated beyond v10.4(1)P2 Release (9736)📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful login from unusual IP
- Configuration changes from unexpected sources
- Privilege level changes in logs
Network Indicators:
- Unexpected management traffic to switch on non-standard ports
- Traffic patterns indicating configuration changes
SIEM Query:
source="switch_logs" (event_type="login" AND result="success") AND (user="admin" OR privilege="15") | stats count by src_ip