CVE-2019-16639: Ruijie Eg-2000se Firmware

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

An issue was found on the Ruijie EG-2000 series gateway. There is a newcli.php API interface without access control, which can allow an attacker (who only has web interface access) to use TELNET commands and/or show admin passwords via the mode_url=exec&command= substring. This affects EG-2000SE EG_RGOS 11.9 B11P1.

Affected products

• Ruijie Eg-2000se Firmware: version 11.9_b11p1 only

Published 2024-07-16. Last modified 2026-06-17.