CVE-2024-2642
📋 TL;DR
This critical vulnerability in Ruijie RG-NBS2009G-P network switches allows remote attackers to execute arbitrary commands via command injection in the /EXCU_SHELL file's Command1 parameter. Attackers can gain full control of affected switches, potentially compromising entire network segments. Organizations using these switches up to March 5, 2024 are at risk.
💻 Affected Systems
- Ruijie RG-NBS2009G-P
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete network compromise allowing attackers to intercept all traffic, deploy ransomware, pivot to other systems, and cause permanent network disruption.
Likely Case
Unauthorized access to switch configuration, traffic interception, network disruption, and lateral movement to connected systems.
If Mitigated
Limited impact if switches are isolated in management VLANs with strict access controls, though command injection could still affect switch functionality.
🎯 Exploit Status
Exploit details are publicly available in PDF format. The vulnerability requires network access to the switch's management interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Contact Ruijie support for firmware updates. Consider replacing affected switches if no patch is forthcoming.
🔧 Temporary Workarounds
Network Segmentation
allIsolate switch management interfaces in dedicated VLAN with strict access controls
Access Control Lists
allImplement strict ACLs to limit access to switch management interfaces
access-list 100 deny ip any any
🧯 If You Can't Patch
- Immediately isolate affected switches from internet and critical network segments
- Implement network monitoring for suspicious traffic to/from switch management interfaces
🔍 How to Verify
Check if Vulnerable:
Check switch firmware version via CLI: show version. If version is 20240305 or earlier, the device is vulnerable.Check Version:
show versionVerify Fix Applied:
Verify firmware has been updated beyond 20240305 version. Test command injection attempts should fail.📡 Detection & Monitoring
Log Indicators:
- Unusual CLI commands in system logs
- Multiple failed authentication attempts followed by successful access
- Commands containing shell metacharacters in EXCU_SHELL access logs
Network Indicators:
- Unusual traffic patterns from switch management interfaces
- Unexpected outbound connections from switches
- Traffic containing command injection payloads
SIEM Query:
source="switch_logs" AND ("EXCU_SHELL" OR "Command1") AND ("|" OR ";" OR "$" OR "`")🔗 References
- https://h0e4a0r1t.github.io/2024/vulns/Ruijie%20RG-NBS2009G-P%20switch%20has%20a%20foreground%20CLI%20command%20injection%20vulnerability.pdf
- https://vuldb.com/?ctiid.257281
- https://vuldb.com/?id.257281
- https://h0e4a0r1t.github.io/2024/vulns/Ruijie%20RG-NBS2009G-P%20switch%20has%20a%20foreground%20CLI%20command%20injection%20vulnerability.pdf
- https://vuldb.com/?ctiid.257281
- https://vuldb.com/?id.257281
