CVE-2024-24116 Scanner

The Ruijie RG-NBS2009G-P is a network switch designed for enterprise-level network management. It is used to provide efficient and secure communication across different network segments, offering features such as VLAN support, routing capabilities, and secure access control. The product is widely deployed in industries that require high-performance networking, such as telecommunications, data centers, and corporate networks. This device runs on RGOS firmware, which provides a platform for managing network configurations. Given its critical role in enterprise infrastructures, securing this device is vital to ensure uninterrupted operations. The vulnerability in question poses a significant security risk to any organization using the affected firmware version.

The vulnerability identified in Ruijie RG-NBS2009G-P allows improper authentication, which can be exploited by an attacker to gain unauthorized access to the device. The issue exists in the system/config_menu.htm endpoint, which lacks proper authentication mechanisms. This means that any attacker who can access this page may gain elevated privileges without the need for valid credentials. This vulnerability has been classified as critical due to its ability to provide remote attackers with administrative-level access to the device. It affects Ruijie's RG-NBS2009G-P switch running the RGOS firmware version 10.4(1)P2 Release(9736). Successful exploitation could lead to significant security breaches within the network.

The improper authentication vulnerability is triggered by accessing the endpoint located at /system/config_menu.htm. The request method used is GET, and the server responds with a status of 200 if the page is accessible. Attackers can exploit this issue by sending crafted requests to this endpoint, where they can find certain response indicators like "configManage.asp" and "reinitIframe()". These indicators suggest a lack of proper access control, allowing attackers to bypass authentication. As a result, attackers can gain access to sensitive system configuration features without proper authorization. The vulnerability is associated with incorrect authentication handling in the Ruijie RGOS firmware.

If exploited, this vulnerability could allow an attacker to gain unauthorized access to the Ruijie RG-NBS2009G-P switch. Once access is gained, the attacker could modify system configurations, inject malicious commands, or even gain full administrative privileges over the device. This could lead to the attacker controlling the network switch, which could result in network outages, data breaches, or the device being used as part of a larger attack, such as a botnet or denial of service (DoS) attack. Given the critical nature of the device in enterprise networks, the impact of this vulnerability could be severe, compromising the integrity and availability of the entire network infrastructure.

REFERENCES

• https://github.com/zty-1995/RG-NBS2009G-P-switch/tree/main/Unauthorized%20Access%20Vulnerability
• https://gist.github.com/zty-1995/7a5e3ad0eb3b6c44db1a6eb4092893d3
• https://nvd.nist.gov/vuln/detail/CVE-2024-24116