CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2024-24116
https://notcve.org/view.php?id=CVE-2024-24116
02 Oct 2024 — An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm. • https://gist.github.com/zty-1995/7a5e3ad0eb3b6c44db1a6eb4092893d3 • CWE-280: Improper Handling of Insufficient Permissions or Privileges •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-2642 – Ruijie RG-NBS2009G-P EXCU_SHELL command injection
https://notcve.org/view.php?id=CVE-2024-2642
19 Mar 2024 — A vulnerability was found in Ruijie RG-NBS2009G-P up to 20240305. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /EXCU_SHELL. The manipulation of the argument Command1 leads to command injection. The attack can be launched remotely. • https://h0e4a0r1t.github.io/2024/vulns/Ruijie%20RG-NBS2009G-P%20switch%20has%20a%20foreground%20CLI%20command%20injection%20vulnerability.pdf • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 192EXPL: 1CVE-2023-38902
https://notcve.org/view.php?id=CVE-2023-38902
17 Aug 2023 — A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers v.EG_3.0(1)B11P219, EAP and RAP series wireless access points v.AP_3.0(1)B11P219, and NBC series wireless controllers v.AC_3.0(1)B11P219 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /cgi-bin/luci/api/cmd via the remoteIp field. • https://gist.github.com/ZIKH26/18693c67ee7d2f8d2c60231b19194c37 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •