CVE-2024-47791
📋 TL;DR
This vulnerability in Ruijie Reyee OS allows attackers to subscribe to partial MQTT topics and intercept messages between devices. It affects Ruijie network devices running Reyee OS versions 2.206.x through 2.319.x. This could expose sensitive device communications and operational data.
💻 Affected Systems
- Ruijie network devices with Reyee OS
📦 What is this software?
Reyee Os by Ruijienetworks
⚠️ Risk & Real-World Impact
Worst Case
Attackers intercept all MQTT communications between devices, gaining full visibility into network operations, device status, and potentially sensitive configuration data.
Likely Case
Partial interception of MQTT messages revealing device telemetry, status updates, and operational commands, potentially enabling further attacks.
If Mitigated
Limited exposure of non-critical telemetry data with proper network segmentation and access controls in place.
🎯 Exploit Status
Exploitation requires network access to MQTT broker but no authentication; simple MQTT client subscription to partial topics.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.320.x or later
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01
Restart Required: Yes
Instructions:
1. Download latest firmware from Ruijie support portal. 2. Backup current configuration. 3. Upload and install firmware version 2.320.x or later. 4. Reboot device. 5. Verify version and functionality.
🔧 Temporary Workarounds
Disable MQTT Service
allTurn off MQTT broker functionality if not required for operations.
configure terminal
no mqtt enable
end
write memory
Restrict MQTT Access
allImplement network ACLs to limit MQTT broker access to trusted hosts only.
configure terminal
access-list 100 permit ip trusted-network any
access-list 100 deny ip any any
interface vlan X
ip access-group 100 in
end
write memory
🧯 If You Can't Patch
- Segment network to isolate Ruijie devices from untrusted networks
- Implement strict firewall rules blocking external access to MQTT port (typically 1883/8883)
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or CLI: show version | include ReyeeCheck Version:
show version | include ReyeeVerify Fix Applied:
Verify version is 2.320.x or later and test MQTT subscription attempts to partial topics fail.📡 Detection & Monitoring
Log Indicators:
- Unusual MQTT subscription patterns
- Multiple failed subscription attempts
- Connections from unexpected IPs to MQTT port
Network Indicators:
- MQTT traffic to/from unexpected sources
- Pattern of subscription requests for partial topics
- Unusual volume of MQTT traffic
SIEM Query:
source="ruijie-logs" AND (event="mqtt_subscribe" AND topic="*#") OR (port=1883 OR port=8883) AND src_ip NOT IN trusted_networks