CVE-2019-16638 Information disclosure in n/a

High 7.5 Published 16 Jul 2024 Updated 18 Mar 2025

An attacker can retrieve cleartext passwords from the Ruijie EG-2000 gateway configuration file using simple XOR operations.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-16638?

CVE-2019-16638 is a high-severity vulnerability in n/a, published on 16 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was found on the Ruijie EG-2000 series gateway. An attacker can easily dump cleartext stored passwords in /data/config.text with simple XORs. This affects EG-2000SE EG_RGOS 11.1(1)B1.

Weakness: CWE-312

Which versions are affected by CVE-2019-16638?

It affects 1 product.

Products include Ruijie Eg-2000se Firmware.

How do I fix CVE-2019-16638?

No fix has been published for CVE-2019-16638 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-16638 being exploited?

There is no known exploitation of CVE-2019-16638 in the wild and no public exploit code.

Sources

Also known as GHSA-rwrj-7c92-9hmp.