CVE-2023-38902 Command injection in n/a
An authorized attacker can execute arbitrary commands on Ruijie routers, switches, and access points via a crafted POST request.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-38902?
CVE-2023-38902 is a high-severity command injection vulnerability in n/a, published on 17 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers v.EG_3.0(1)B11P219, EAP and RAP series wireless access points v.AP_3.0(1)B11P219, and NBC series wireless controllers v.AC_3.0(1)B11P219 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /cgi-bin/luci/api/cmd via the remoteIp field.
Weakness: CWE-77
Which versions are affected by CVE-2023-38902?
It affects 96 products.
Products include Ruijie Rg-Eap101 Firmware, Ruijie Rg-Eap101 V2 Firmware, Ruijie Rg-Eap102\(f\) Firmware, Ruijie Rg-Eap102 Firmware, Ruijie Rg-Eap102 V2 Firmware, Ruijie Rg-Eap162\(g\) Firmware and 90 more.
How do I fix CVE-2023-38902?
No fix has been published for CVE-2023-38902 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-38902 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-38902 exists.
Sources
Also known as GHSA-qf45-5h68-rp79.