CVE-2024-46874 — Ruijie Reyee OS Improper Handling of Insufficient Permissions or Privileges

CVE-2024-46874

Ruijie Reyee OS Improper Handling of Insufficient Permissions or Privileges PUBLISHED

Description (CNA)

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credentials to send messages to some topics. Attackers with device credentials could issue commands to other devices on behalf of Ruijie's cloud.

Affected (CNA)

Vendor / product	Versions
Ruijie / Reyee OS	affected 2.206.x before 2.320.x

CWE

CWE-280

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.