CVE-2023-3450

Deeper analysis

A vulnerability classified as critical was found in Ruijie RG-BCR860 version 2.5.13, specifically in an unknown processing function of the Network Diagnostic Page component. The issue stems from improper handling of input that permits OS command injection, tracked under CWE-78, and carries a CVSS 3.1 score of 4.7 reflecting network attack vector, low attack complexity, and high privileges required.

An attacker with administrative credentials can initiate the attack remotely against the affected device to execute arbitrary operating system commands, resulting in limited impacts to confidentiality, integrity, and availability. The exploit has been made public via disclosure and does not require user interaction beyond the required privileges.

Public references, including detailed write-ups on Vuldb and a GitHub repository containing proof-of-concept material, document the flaw but contain no information on vendor-issued patches or mitigations; the vendor was notified prior to disclosure yet provided no response.

The associated EPSS score stands at 0.6145 with an identical recorded peak, indicating moderate exploitation probability without evidence of a post-disclosure increase.