CVE-2025-9424CWE-77CWE-78

Ruijie WS7204-A branch_import.php os command injection

Medium · published August 25, 2025

CVSS v4.0

5.1

EPSS

15%

Percentile

96.7

In the wild

Unconfirmed

What it is

A vulnerability was identified in Ruijie WS7204-A 2017.06.15. Affected by this vulnerability is an unknown functionality of the file /itbox_pi/branch_import.php?a=branch_list. Such manipulation of the argument province leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record

Technical detail

CVSS v4.0: 5.1 · MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS: 0.15172 · 96.7th percentile
Weaknesses: CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2025-08-25T22:32Z

EPSS history

Timeline

25 AUG 22:32Z
Ruijie WS7204-A branch_import.php os command injection
cvelistv5