CVE-2023-53881

Devices running ReyeeOS send unencrypted HTTP polling requests to the CWMP server (TR-069 protocol). An attacker positioned on the network path can intercept this communication and substitute a fake CWMP server. Since the requests are not protected by encryption or integrity verification, the attacker can inject arbitrary commands into the response, which the device will then execute with the appropriate privileges.

An attacker can remotely execute arbitrary commands (RCE) on Ruijie Reyee Cloud devices, gaining full control over the device, including the ability to modify configuration, intercept network traffic, or use the device as an entry point to the internal network.

Patches available from the manufacturer should be applied according to the references. Additionally, until the fix is deployed, network segmentation is recommended, restricting device access to the Internet through a dedicated firewall, and monitoring network traffic for suspicious CWMP connections.

Ruijie Networks ReyeeOS version 1.204.1614 on Ruijie Reyee Cloud devices