双草酸酯

**Name of the Vulnerable Software and Affected Versions** Ruijie EG-2000 series gateway versions EG-2000SE EG RGOS 11.1(1)B1. **Description** The issue is related to a buffer overflow in the `client.so` file of the Ruijie EG-2000 series gateway. This allows an attacker to login to any account without providing a password by utilizing the `login.php` script. The exploitation of this issue can enable a remote attacker to gain access to an account and login to the system. **Recommendations** For Ruijie EG-2000SE EG RGOS 11.1(1)B1, consider restricting access to the `login.php` script until a patch is available. As a temporary workaround, disabling the `client.so` file may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ruijie EG-2000SE versions 11.9 B11P1 **Description** The issue is related to the newcli.php API interface in the Ruijie EG-2000SE gateway, which lacks access control. This allows an attacker with web interface access to use TELNET commands and potentially show admin passwords via the "mode url=exec&command=" substring. Exploitation of this issue can enable a remote attacker to elevate privileges and gain unauthorized access to protected information. **Recommendations** For version 11.9 B11P1, consider restricting access to the newcli.php API interface until a patch is available. As a temporary workaround, avoid using the "mode url=exec&command=" substring in the API endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Ruijie EG-2000SE versions 11.9 B11P1 **Description** The issue is related to the upload.php script in the Ruijie EG-2000SE gateway, specifically with the UploadFile class. It allows for unrestricted file upload of dangerous file types. An attacker can exploit this to upload arbitrary files to the gateway. The vulnerability is due to a mishandled parameter passed to the UploadFile class, where `%00` and `/var/./html` are not properly checked. **Recommendations** For version 11.9 B11P1, consider restricting access to the upload.php script and the UploadFile class until a patch is available. As a temporary workaround, avoid using the vulnerable upload functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ruijie EG-2000 series gateway versions 11.1(1)B1 **Description** The issue affects the Ruijie EG-2000 series gateway, where an attacker can easily dump cleartext stored passwords in /data/config.text using simple XORs. This allows a remote attacker to reset passwords. **Recommendations** For version 11.1(1)B1, consider restricting access to the /data/config.text file until a patch is available. As a temporary workaround, avoid using simple XORs for password storage in the affected gateway. At the moment, there is no information about a newer version that contains a fix for this vulnerability.