Paper/Archive/CVE-2023-7330

CVE-2023-7330

Beijing Star-Net Ruijie Network Technology Co., Ltd. NBR Series Routers — Ruijie Networks NBR Routers Unauthenticated Arbitrary File Upload via fileupload.php

EPSS 0.7%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 51.9.519 × 2010.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Ruijie NBR series routers contain an unauthenticated arbitrary file upload vulnerability via /ddi/server/fileupload.php. The endpoint accepts attacker-supplied values in the name and uploadDir parameters and saves the provided multipart file content without adequate validation or sanitization of file type, path, or extension. A remote attacker can upload a crafted PHP file and then access it from the web root, resulting in arbitrary code execution in the context of the web service. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-14 UTC.

Affected

ProductAffectedFixed inSource

NBR Series Routersall versions–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

exploitgithub.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/ruijie/ruijie-nbr-fileupload.yaml exploitcn-sec.com/archives/1995366.html exploitcnblogs.com/Domren/articles/19093295 exploitrfk0z.github.io/posts/Ruijie-NBR-router-fileupload-php-arbitrary-file-upload-vulnerability writeupvulncheck.com/advisories/ruijie-networks-nbr-routers-unauthenticated-arbitrary-file-upload-via-fileuploadphp