by Kastro
Paper/Archive/CVE-2024-46874

CVE-2024-46874

Ruijie Reyee OS — Ruijie Reyee OS Improper Handling of Insufficient Permissions or Privileges

EPSS 0.4%CVSS 9.9
critical.is priorityof 100
37
CVSS 9.9 (NVD)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 34.4.344 × 206.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credentials to send messages to some topics. Attackers with device credentials could issue commands to other devices on behalf of Ruijie's cloud.

Affected

ProductAffectedFixed inSource
Reyee OS2.206.x – < 2.320.x2.320.xCNA
reyee_os2.206.x – < 2.320.x2.320.xCISA-ADP

Scores by source

NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
icscert (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
icscert (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-24-338-01