CVE-2024-51727: Ruijie Reyee OS DOS Vulnerability

CVE-2024-51727 Overview

CVE-2024-51727 affects Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x. The vulnerability allows a remote authenticated attacker to invalidate an active session belonging to a legitimate user, producing a denial-of-service condition against the targeted account. The flaw is classified under [CWE-826: Premature Release of Resource During Expected Lifetime]. Ruijie Reyee OS runs on cloud-managed networking equipment widely deployed in enterprise and small-business environments, making disruption of administrative sessions operationally significant.

Critical Impact
A low-privileged network attacker can forcibly terminate another user's authenticated session, denying access to legitimate account holders and disrupting device management workflows.

Affected Products

Ruijie Reyee OS 2.206.x through versions prior to 2.320.x
Ruijie Networks cloud-managed switches running vulnerable Reyee OS builds
Ruijie Networks wireless access points running vulnerable Reyee OS builds

Discovery Timeline

2024-12-06 - CVE-2024-51727 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51727

Vulnerability Analysis

The vulnerability resides in a feature of Ruijie Reyee OS that manages user session state. An authenticated attacker with low privileges can invoke functionality that invalidates the session token of another legitimate user. Once the target session is invalidated, the affected user is logged out and cannot maintain continuous access to the management interface.

The impact is limited to availability of the user account rather than confidentiality or integrity of device data. However, repeated exploitation can prevent administrators from performing configuration changes, monitoring device health, or responding to incidents on the affected equipment. The issue is tracked in CISA ICS Advisory ICSA-24-338-01.

Root Cause

The root cause is improper handling of session lifetime, categorized as [CWE-826: Premature Release of Resource During Expected Lifetime]. The Reyee OS session management logic does not adequately isolate one user's session state from actions taken by other authenticated users. As a result, an attacker with valid credentials can trigger session release for accounts other than their own.

Attack Vector

Exploitation requires network access to the Reyee OS management interface and valid low-privileged credentials. The attacker sends a crafted request that causes the backend to release the session resource associated with the victim account. No user interaction is required on the victim side. Because Reyee-managed devices are often accessible through cloud portals, the attack surface can extend beyond the local network.

No public proof-of-concept exploit code is available for CVE-2024-51727. Refer to the CISA ICS Advisory ICSA-24-338-01 for vendor-provided technical context.

Detection Methods for CVE-2024-51727

Indicators of Compromise

Unexpected session termination events in Reyee OS audit logs for administrator accounts
Repeated forced logouts of the same user account within a short interval
Authentication events from low-privileged accounts immediately preceding session invalidation events for higher-privileged users

Detection Strategies

Enable and centralize Reyee OS management-plane logging to a SIEM or data lake for correlation
Alert on abnormal patterns of session termination not tied to explicit user logout actions
Correlate low-privileged account activity with session state changes affecting other users

Monitoring Recommendations

Monitor administrative interfaces of Ruijie devices for unusual API calls from non-administrator accounts
Track failed reconnection attempts by administrators that follow forced session terminations
Review cloud portal access logs for authenticated sessions originating from unexpected geolocations

How to Mitigate CVE-2024-51727

Immediate Actions Required

Upgrade Ruijie Reyee OS to version 2.320.x or later, which is outside the affected range
Audit all Reyee OS accounts and remove unused or low-privileged accounts that do not require management access
Rotate credentials for any accounts that may have been shared or exposed

Patch Information

Ruijie Networks addresses the issue in Reyee OS releases at or after 2.320.x. Administrators should consult the CISA ICS Advisory ICSA-24-338-01 and coordinate with Ruijie support to confirm the target firmware version for each device model prior to deployment.

Workarounds

Restrict access to the Reyee OS management interface to trusted management networks using ACLs or firewall rules
Enforce strong, unique passwords and multi-factor authentication where supported to reduce risk from compromised low-privileged credentials
Segment cloud-managed networking equipment from general user networks to limit exposure of the management plane

bash

# Example ACL restricting Reyee OS management access to a trusted subnet
access-list 10 permit 10.10.0.0 0.0.0.255
access-list 10 deny any log
line vty 0 4
 access-class 10 in