Ruijie Eg-2000se Firmware vulnerabilities

4 CVEs affecting Ruijie Eg-2000se Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-16641, published 2024-07-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-16639, published 2024-07-16. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. An issue was found on the Ruijie EG-2000 series gateway. There is a newcli.php API interface without access control, which can allow an attacker (who only has web interface access) to use TELNET…
CVE-2019-16640, published 2024-07-16. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. An issue was found in upload.php on the Ruijie EG-2000 series gateway. A parameter passed to the class UploadFile is mishandled (%00 and /var/./html are not checked), which can allow an attacker to…
CVE-2019-16638, published 2024-07-16. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. An issue was found on the Ruijie EG-2000 series gateway. An attacker can easily dump cleartext stored passwords in /data/config.text with simple XORs. This affects EG-2000SE EG_RGOS 11.1(1)B1.
CVE-2019-16641, published 2024-07-16. High severity, CVSS 8.4. EPSS: 0.3% chance of exploitation in the next 30 days. An issue was found on the Ruijie EG-2000 series gateway. There is a buffer overflow in client.so. Consequently, an attacker can use login.php to login to any account, without providing its password.…