CVE-2023-34644: Ruijie Rg-ew1200r Firmware RCE Vulnerability

CVE-2023-34644 Overview

CVE-2023-34644 is a critical remote code execution vulnerability affecting multiple Ruijie Networks product lines including home routers, business VPN routers, network switches, wireless access points, and wireless controllers. The vulnerability allows unauthorized remote attackers to gain the highest privileges on affected devices by sending specially crafted POST requests to the /cgi-bin/luci/api/auth endpoint.

This authentication bypass vulnerability in the LuCI web interface enables attackers to completely compromise network infrastructure devices without requiring any prior authentication, making it particularly dangerous for enterprise and home network environments.

Critical Impact

Unauthorized attackers can remotely gain root-level access to affected Ruijie network devices, enabling complete device takeover, network traffic interception, and potential lateral movement across the network infrastructure.

Affected Products

• Ruijie RG-EW series home routers and repeaters (firmware EW_3.0(1)B11P204) - including RG-EW1200, RG-EW1200G, RG-EW1200R, RG-EW1800GX, RG-EW300, RG-EW300R, RG-EW3200GX
• Ruijie RG-EG series business VPN routers (firmware EG_3.0(1)B11P216) - including RG-EG105G, RG-EG1000C, RG-EG1000E, RG-EG2000CE, RG-EG3000XE, RG-EG3230, RG-EG3250
• Ruijie RG-NBS and RG-S1930 series switches (firmware SWITCH_3.0(1)B11P218)
• Ruijie EAP and RAP series wireless access points (firmware AP_3.0(1)B11P218)
• Ruijie NBC series wireless controllers (firmware AC_3.0(1)B11P86) - including RG-NBC256, RG-NBC512

Discovery Timeline

• 2023-07-31 - CVE-2023-34644 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-34644

Vulnerability Analysis

This vulnerability exists in the authentication API endpoint of the LuCI web interface used across multiple Ruijie Networks product lines. The authentication mechanism fails to properly validate incoming POST requests to the /cgi-bin/luci/api/auth endpoint, allowing unauthenticated attackers to bypass authentication controls entirely.

The flaw is classified as CWE-94 (Improper Control of Generation of Code, or 'Code Injection'), indicating that attackers can inject and execute arbitrary code on the device. The vulnerability requires no authentication, no user interaction, and can be exploited remotely over the network, making it trivially exploitable by attackers who can reach the device's management interface.

Successful exploitation grants attackers the highest privileges on the device, enabling them to execute arbitrary commands, modify device configurations, intercept network traffic, install persistent backdoors, or use the compromised device as a pivot point for further attacks within the network.

Root Cause

The root cause of CVE-2023-34644 lies in inadequate input validation and authentication verification within the LuCI authentication API handler. The /cgi-bin/luci/api/auth endpoint fails to properly sanitize and validate POST request parameters before processing authentication attempts.

This allows attackers to craft malicious POST requests that bypass normal authentication flows, directly injecting code that gets executed with root privileges. The vulnerability affects the shared firmware codebase across multiple Ruijie product lines, which explains the extensive list of affected devices.

Attack Vector

The attack vector for this vulnerability is network-based, requiring only that the attacker can reach the web management interface of the vulnerable device. The exploitation flow involves:

1. Attacker identifies a vulnerable Ruijie device with an exposed management interface
2. Attacker crafts a malicious POST request targeting the /cgi-bin/luci/api/auth endpoint
3. The malformed request bypasses authentication and injects executable code
4. The injected code executes with root privileges on the device
5. Attacker gains complete control of the network device

The attack can be executed from any network position that has access to the device's management interface, including the internet if the management interface is publicly accessible.

Detection Methods for CVE-2023-34644

Indicators of Compromise

• Unexpected HTTP POST requests to /cgi-bin/luci/api/auth from external or unauthorized IP addresses
• Anomalous process execution or new processes spawned on Ruijie devices
• Unauthorized configuration changes or new administrative accounts on affected devices
• Unusual outbound network connections from network infrastructure devices

Detection Strategies

• Implement network intrusion detection rules to monitor for malicious POST requests targeting /cgi-bin/luci/api/auth endpoints
• Deploy web application firewall (WAF) rules to filter suspicious authentication API requests to Ruijie devices
• Enable and monitor device logs for authentication failures and anomalous administrative actions
• Conduct regular configuration audits to detect unauthorized changes on network infrastructure devices

Monitoring Recommendations

• Monitor network traffic to and from Ruijie device management interfaces for anomalous patterns
• Implement SIEM alerts for authentication bypass attempts and unusual administrative activity on network devices
• Regularly audit user accounts and access permissions on all affected Ruijie products
• Enable comprehensive logging on all network infrastructure devices and forward logs to centralized monitoring systems

How to Mitigate CVE-2023-34644

Immediate Actions Required

• Update all affected Ruijie devices to the latest firmware versions that address this vulnerability immediately
• Restrict management interface access to trusted networks only using firewall rules or VLANs
• Disable remote management interfaces if not required, especially on internet-facing devices
• Audit all affected devices for signs of compromise before and after patching

Patch Information

Ruijie Networks has released firmware updates to address this vulnerability. Organizations should consult the Ruijie Security Advisory and the Ruijie Networks Cybersecurity Bulletin for specific patched firmware versions for their affected products.

Given the breadth of affected products, administrators should inventory all Ruijie devices in their environment and prioritize patching based on exposure risk, with internet-facing and business-critical devices receiving immediate attention.

Workarounds

• Isolate affected devices on a separate management VLAN with strict access controls until patches can be applied
• Implement network-level access control lists (ACLs) to restrict access to device management interfaces from trusted IP addresses only
• Place a reverse proxy or web application firewall in front of device management interfaces to filter malicious requests
• If device management is not required remotely, disable the web interface entirely and manage devices through console connections only

# Example firewall rule to restrict management interface access (iptables)
# Replace MANAGEMENT_IP with your trusted management network
iptables -A INPUT -p tcp --dport 80 -s MANAGEMENT_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s MANAGEMENT_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP