CVE-2024-42494: Ruijie Reyee OS Information Disclosure

CVE-2024-42494 Overview

CVE-2024-42494 affects Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x. The vulnerability stems from a product feature that allows sub accounts or attackers to view and exfiltrate sensitive information from all cloud accounts registered to Ruijie's services. The flaw is classified under CWE-359: Exposure of Private Personal Information to an Unauthorized Actor. Exploitation requires low-privilege network access and enables cross-tenant data disclosure across the Ruijie cloud environment.

Critical Impact
A low-privileged sub account can enumerate and exfiltrate sensitive data belonging to all cloud accounts registered to Ruijie's services, breaking tenant isolation.

Affected Products

Ruijie Networks Reyee OS versions 2.206.x through versions before 2.320.x
Cloud-managed Ruijie devices operating on affected Reyee OS builds
Sub accounts provisioned under Ruijie cloud tenants

Discovery Timeline

2024-12-06 - CVE CVE-2024-42494 published to NVD
2024-12-03 - CISA publishes ICS Advisory ICSA-24-338-01
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-42494

Vulnerability Analysis

The vulnerability resides in the multi-tenant account model implemented by Ruijie Reyee OS cloud services. A sub account, which should be scoped to a single parent tenant, can access data belonging to unrelated cloud accounts registered to the Ruijie platform. This breaks the tenant isolation boundary that cloud-managed network operating systems rely on for confidentiality.

An attacker holding valid sub-account credentials, or one who compromises such an account, can query information that belongs to other customers. The exposed data can include device metadata, configuration details, and account information tied to unrelated Ruijie cloud tenants. Because the flaw is a design-level feature rather than a memory-safety bug, no crafted payload is required to trigger it.

Root Cause

The root cause is insufficient authorization enforcement in a Reyee OS cloud feature that governs how sub accounts view resources. Access decisions do not correctly restrict a sub account's visibility to its parent tenant's scope. This maps to CWE-359, exposure of sensitive information to an unauthorized actor.

Attack Vector

The attack vector is network based and requires low privileges. An authenticated sub account interacts with the Reyee cloud service and requests information beyond its authorization boundary. The service returns data belonging to other cloud accounts, enabling exfiltration at scale without user interaction on the victim side.

See the CISA ICS Advisory ICSA-24-338-01 for the technical description published by the coordinating authority. No public proof-of-concept exploit is currently listed for this CVE.

Detection Methods for CVE-2024-42494

Indicators of Compromise

Sub account API sessions retrieving resource identifiers or device data that do not belong to the parent tenant.
Unusual volume of read or export operations initiated by a single sub account against the Ruijie cloud portal.
Access patterns originating from sub-account credentials at times or geolocations inconsistent with the account owner's baseline.

Detection Strategies

Correlate cloud portal audit logs with tenant ownership records to identify cross-tenant reads by sub accounts.
Baseline expected API call patterns for each sub account and alert on deviations in resource enumeration.
Review authentication logs for sub accounts that suddenly access administrative or bulk-export endpoints.

Monitoring Recommendations

Enable and centralize Ruijie cloud audit logs in a SIEM for retention and correlation.
Alert on any sub account performing bulk queries returning data across more than one parent account identifier.
Track firmware and Reyee OS version inventory to identify devices still running affected 2.206.x through pre-2.320.x builds.

How to Mitigate CVE-2024-42494

Immediate Actions Required

Upgrade all Ruijie Reyee OS devices to version 2.320.x or later as directed by the vendor and CISA.
Audit all sub accounts across Ruijie cloud tenants and disable any that are unused or unrecognized.
Rotate credentials for administrator and sub accounts, and enforce multi-factor authentication where supported.

Patch Information

Ruijie has addressed the issue in Reyee OS builds at or after version 2.320.x. Refer to the CISA ICS Advisory ICSA-24-338-01 for the coordinated vendor guidance and version details. Verify device firmware after the update to confirm the fixed build is in place.

Workarounds

Restrict sub-account creation and limit sub-account roles to the minimum required scope.
Remove access for sub accounts that do not require cloud portal privileges until patched firmware is deployed.
Restrict management-plane access to the Ruijie cloud portal using network-level controls where feasible.

bash

# Verify Reyee OS build meets or exceeds the fixed version
# (run from device CLI, output format varies by model)
show version | include Reyee

# Example expected output after patching
# Reyee OS Version: 2.320.x