CVE-2024-42494 Ruijie Reyee OS Exposure of Private Personal Information to an Unauthorized Actor
Attackers can view and exfiltrate sensitive personal information from all cloud accounts registered to Ruijie services via a sub-account feature.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-42494?
CVE-2024-42494 is a high-severity vulnerability in Ruijie Reyee OS, published on 6 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a a feature that could enable sub accounts or attackers to view and exfiltrate sensitive information from all cloud accounts registered to Ruijie's services
Weakness: CWE-359
Which versions are affected by CVE-2024-42494?
It affects 1 product.
Products include Ruijienetworks Reyee Os.
How do I fix CVE-2024-42494?
No fix has been published for CVE-2024-42494 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-42494 being exploited?
There is no known exploitation of CVE-2024-42494 in the wild and no public exploit code.
Other vulnerabilities in Ruijie Reyee OS
- CVE-2024-47547 Ruijie Reyee OS Weak Password Recovery Mechanism for Forgotten Password
- CVE-2024-48874 Ruijie Reyee OS Server-Side Request Forgery
- CVE-2023-53881 ReyeeOS 1.204.1614 Man-in-the-Middle Remote Code Execution via CWMP
- CVE-2024-46874 Ruijie Reyee OS Improper Handling of Insufficient Permissions or Privileges
- CVE-2024-52324 Ruijie Reyee OS Use of Inherently Dangerous Function
Sources
Also known as GHSA-29xv-m659-vj7w.