CVE-2025-9424

Name of the Vulnerable Software and Affected Versions: Ruijie WS7204-A version 2017.06.15

Description: A vulnerability exists in Ruijie WS7204-A 2017.06.15 related to os command injection. The issue is located in the file /itbox pi/branch import.php?a=branch list, where manipulation of the province argument can lead to remote code execution. The exploit is publicly available.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the file /itbox pi/branch import.php to minimize the risk of exploitation. Avoid using the province parameter in the /itbox pi/branch import.php?a=branch list endpoint until the issue is resolved.