CVE-2024-47043
📋 TL;DR
This vulnerability in Ruijie Reyee OS allows attackers to correlate device serial numbers with user phone numbers and partial email addresses. It affects Ruijie Reyee OS versions 2.206.x through 2.319.x, potentially exposing sensitive user information.
💻 Affected Systems
- Ruijie Reyee OS
📦 What is this software?
Reyee Os by Ruijienetworks
⚠️ Risk & Real-World Impact
Worst Case
Attackers could build comprehensive user profiles by combining leaked data with other sources, enabling targeted phishing, social engineering, or identity theft attacks.
Likely Case
Information disclosure leading to privacy violations, potential targeted spam/phishing campaigns against affected users.
If Mitigated
Limited exposure of partial personal information without other context, minimal operational impact.
🎯 Exploit Status
Information disclosure vulnerability requiring access to the system
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.320.x or later
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01
Restart Required: Yes
Instructions:
1. Check current Reyee OS version. 2. Download and install version 2.320.x or later from Ruijie support portal. 3. Reboot affected devices. 4. Verify update completion.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Ruijie devices from untrusted networks to limit exposure
Access Control Restrictions
allImplement strict access controls to limit who can query device information
🧯 If You Can't Patch
- Implement network segmentation to isolate Ruijie devices
- Apply strict access controls and monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check Reyee OS version via device web interface or CLI: show versionCheck Version:
show versionVerify Fix Applied:
Confirm OS version is 2.320.x or later using show version command📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to device information endpoints
- Multiple serial number queries from single source
Network Indicators:
- Unexpected API calls to device information endpoints
- Traffic patterns suggesting data harvesting
SIEM Query:
source="ruijie-device" AND (event="serial_query" OR event="user_info_access")