CVE-2024-46874CWE-280

Ruijie Reyee OS Improper Handling of Insufficient Permissions or Privileges

Critical · published December 6, 2024

CVSS v4.0
9.2
EPSS
0%
Percentile
33.3
In the wild
Unconfirmed
What it is

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credentials to send messages to some topics. Attackers with device credentials could issue commands to other devices on behalf of Ruijie's cloud.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00402 · 33.3th percentile
Weakness
CWE-280 · Improper Handling of Insufficient Permissions or Privileges
Published
2024-12-06T18:18Z
EPSS history
Timeline
  • 06 DEC 18:18Z
    Ruijie Reyee OS Improper Handling of Insufficient Permissions or Privileges
    cvelistv5