CVE-2024-47791: Ruijie Reyee OS Information Disclosure

CVE-2024-47791 Overview

CVE-2024-47791 affects Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x. The vulnerability allows an unauthenticated remote attacker to subscribe to partial topics in the Ruijie Message Queuing Telemetry Transport (MQTT) broker. Once subscribed, the attacker can receive a subset of messages exchanged between managed devices and the cloud service. The weakness maps to CWE-155: Improper Neutralization of Wildcards or Matching Symbols. CISA published details in ICS Advisory ICSA-24-338-01.

Critical Impact
Unauthenticated network attackers can passively intercept device telemetry and control messages transiting the Ruijie MQTT broker, exposing sensitive operational data.

Affected Products

Ruijie Reyee OS 2.206.x
Ruijie Reyee OS versions above 2.206.x and below 2.320.x
Cloud-connected Ruijie networking devices running affected Reyee OS builds

Discovery Timeline

2024-12-06 - CVE-2024-47791 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-47791

Vulnerability Analysis

Ruijie Reyee OS devices communicate with Ruijie cloud services through an MQTT broker. MQTT uses a publish/subscribe model where clients subscribe to topics using literal names or wildcard patterns. The affected Reyee OS builds permit clients to subscribe to broker topics using wildcard or partial-topic matching without adequately restricting access to messages intended for other tenants and devices.

An attacker who connects to the broker can enumerate wildcard subscriptions and receive a portion of the messages flowing between devices and the Ruijie cloud. These messages can include device identifiers, configuration data, and command traffic. The flaw is a confidentiality issue; integrity and availability of the broker are not directly affected.

Root Cause

The root cause is improper neutralization of MQTT wildcard characters ([CWE-155]) inside topic authorization checks. The broker fails to constrain subscriptions to a client's authorized topic namespace, so wildcard subscriptions match messages belonging to unrelated devices and accounts.

Attack Vector

Exploitation occurs entirely over the network with no authentication or user interaction required. An attacker establishes an MQTT session to the Ruijie broker and issues subscribe requests using wildcard patterns. The broker returns matching device-to-cloud messages that the attacker was not authorized to observe. The vulnerability is described in prose only; no verified public proof-of-concept exists at this time. See ICS Advisory ICSA-24-338-01 for vendor and coordination details.

Detection Methods for CVE-2024-47791

Indicators of Compromise

Unexpected MQTT SUBSCRIBE packets containing wildcard characters (+ or #) targeting broker topics
Outbound MQTT sessions from unfamiliar client identifiers to Ruijie cloud endpoints
Sustained MQTT subscriber sessions that receive traffic across multiple device identifiers

Detection Strategies

Inspect MQTT traffic on TCP 1883 and TLS 8883 for subscribe patterns using wildcards against topics that reference multiple device serial numbers or tenants
Correlate broker connection logs with expected device inventory to detect unauthorized client IDs
Alert on MQTT clients that subscribe to topic hierarchies broader than a single device scope

Monitoring Recommendations

Enable verbose logging on upstream network devices for MQTT sessions until vendor patches are deployed
Capture full packet metadata for MQTT sessions traversing perimeter firewalls for retroactive analysis
Track firmware versions across the Reyee fleet and flag any device running builds between 2.206.x and 2.320.x

How to Mitigate CVE-2024-47791

Immediate Actions Required

Upgrade all affected devices to Ruijie Reyee OS version 2.320.x or later, per ICSA-24-338-01
Inventory every Reyee-managed device and confirm current firmware against the affected version range
Rotate any credentials or pre-shared keys that may have transited the broker while affected firmware was in use

Patch Information

Ruijie Networks addressed the vulnerability in Reyee OS 2.320.x and later. The fix is delivered through the Ruijie cloud management channel. Refer to the CISA ICS Advisory ICSA-24-338-01 for coordination details and vendor guidance.

Workarounds

Restrict outbound network access from Reyee-managed devices to only the required Ruijie cloud endpoints
Segment management networks so that a compromised broker session cannot pivot to internal systems
Where feasible, isolate affected devices from production traffic until the firmware upgrade completes

bash

# Verify Reyee OS version on managed devices and identify vulnerable builds
# Replace placeholders with your environment values
show version | include Software
# Vulnerable if version is >= 2.206.x and < 2.320.x
# Upgrade path: obtain 2.320.x or later from the Ruijie cloud portal