CVE-2024-46874

Reyee OS improperly manages MQTT client permissions — a client authenticated with credentials of a single device can publish messages to MQTT topics that should be accessible only to the trusted cloud backend. An attacker who has obtained credentials of any device can connect to the MQTT broker and send crafted commands to other devices managed by the Ruijie cloud. The vulnerability is classified as CWE-280 (Improper Handling of Insufficient Permissions or Privileges), indicating a lack of proper verification of permission scope at the MQTT communication level.

An attacker possessing authentication credentials of one device can execute unauthorized commands on other network devices in the Reyee ecosystem, effectively impersonating the manufacturer's cloud server — which may lead to takeover of network devices, changes to their configuration, or disruption of infrastructure operation.

Update Ruijie Reyee OS to version 2.320.x or later. Detailed information regarding updates is available in the ICS-CERT notification at: https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01. Additionally, it is recommended to restrict access to the MQTT broker at the network level and monitor unauthorized MQTT connections.

Ruijie Reyee OS in versions from 2.206.x to versions prior to 2.320.x.