by Kastro
Paper/Archive/CVE-2024-28288

CVE-2024-28288

ruijie rg-nbr700gw_firmware — Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrator password reset…

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.1.541 × 2010.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrator password reset vulnerability. An attacker can use this vulnerability to log in to the device and disrupt the business of the enterprise.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
rg-nbr700gw_firmware10.3\(4b12\)–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refpan.baidu.com/s/1H4J_eA6wSCnDEsUSAWIzsg?pwd=CVE1refgithub.com/adminquit/CVE-2024-28288/blob/d8223c6d45af877669c27fa0a95adfe51924fa86/CVE-2024-28288/CVE-2024-28288.md