CVE-2024-46874

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credentials to send messages to some topics. Attackers with device credentials could issue commands to other devices on behalf of Ruijie's cloud.

Score

CVSS 3.1 9.9 Critical

Status

Analyzed - ics-cert@hq.dhs.gov

Published

2024-12-06

Last modified

2024-12-06

Weaknesses

CWE-280

Affected products

• Reyee Os (Ruijie)
• Reyee Os (Ruijienetworks)

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01