CVE-2024-24116 — AI Deep Analysis Summary

🚨 **Essence**: Critical **Unauthorized Access** flaw in Ruijie RG-NBS2009G-P. <br>📉 **Consequences**: Attackers bypass security controls to gain **system privileges**.…

🛡️ **Root Cause**: Improper access control on the web interface.…

🏢 **Affected Vendor**: Ruijie Networks (锐捷网络). <br>📦 **Product**: RG-NBS2009G-P (Enterprise Firewall). <br>📌 **Version**: Specifically **v.10.4(1)P2 Release(9736)**.

💀 **Attacker Action**: Remote exploitation via HTTP requests. <br>🔑 **Privileges**: Gains **administrative privileges**.…

⚡ **Threshold**: **LOW**. <br>🔓 **Auth**: No authentication required. <br>🌐 **Config**: Remote exploitation possible. Any internet-facing instance of this specific version is vulnerable.

🔥 **Public Exp?**: **YES**. <br>📜 **PoC**: Available via Nuclei templates and GitHub repositories (e.g., `zty-1995`). <br>⚠️ **Status**: Wild exploitation is highly likely given the ease of access.

🔍 **Self-Check**: Scan for the specific URL path: `system/config_menu.htm`. <br>🛠️ **Tool**: Use Nuclei with the CVE-2024-24116 template. <br>👀 **Visual**: If the config menu loads without login, you are vulnerable.

🩹 **Official Fix**: Check Ruijie Networks for a security advisory. <br>📥 **Patch**: Update RGOS firmware to a version newer than 10.4(1)P2 Release(9736) if available.…

🚧 **Workaround**: **Block External Access**. <br>🚫 **Action**: Restrict access to `system/config_menu.htm` via ACLs or WAF. <br>🔒 **Limit**: Only allow management from trusted internal IPs.…

🚨 **Urgency**: **CRITICAL**. <br>⏱️ **Priority**: **IMMEDIATE ACTION**. <br>📢 **Reason**: Unauthenticated remote code/config execution on a firewall. Do not wait for a patch; mitigate immediately.