Ruijie Networks' Cloud Platform Flaws Could Expose 50,000 Devices to Remote Attacks

Latest News on Ruijie Networks Cloud Platform Vulnerabilities 2024:

1. Security Flaws in Ruijie Networks' Cloud Platform:

   • Cybersecurity researchers have discovered several critical vulnerabilities in the cloud management platform developed by Ruijie Networks. These flaws could permit an attacker to take control of network appliances, potentially affecting tens of thousands of devices123.

2. Open Sesame Attack:

   • The "Open Sesame" attack, which has been assigned the CVE identifier CVE-2024-47146, allows an attacker physically adjacent to a Wi-Fi network using Ruijie access points to extract the device's serial number. This information can then be used to exploit other MQTT communication vulnerabilities, achieving remote code execution124.

3. CVE Vulnerabilities:

   • The identified vulnerabilities include:
     • CVE-2024-47547 (CVSS score of 9.4): A weak password recovery mechanism vulnerable to brute force attacks1.
     • CVE-2024-48874 (CVSS score of 9.8): A server-side request forgery (SSRF) vulnerability that could be exploited to access internal services via AWS cloud metadata services1.
     • CVE-2024-52324 (CVSS score of 9.8): The use of an inherently dangerous function that could allow an attacker to send a malicious MQTT message, resulting in devices executing arbitrary operating system commands1.
     • CVE-2024-45722 (CVSS score of 7.5): Breaking MQTT authentication by knowing the device's serial number, which can be used to generate valid authentication credentials for all cloud-connected devices1.

4. Impact and Mitigation:

   • The vulnerabilities were identified by Claroty researchers, who also devised the "Open Sesame" attack. Following responsible disclosure, Ruijie Networks has fixed all identified shortcomings, and no user action is required. Approximately 50,000 cloud-connected devices were potentially impacted by these bugs123.

5. Context in IoT Security:

   • This discovery highlights weaknesses in IoT devices such as wireless access points and routers, which have a low barrier to entry but enable deeper network attacks. It underscores the need for robust security measures in IoT ecosystems12.

These findings emphasize the importance of continuous security monitoring and patching in cloud and IoT environments to prevent such vulnerabilities from being exploited.