CVE-2025-58778: RG-EST300 Auth Bypass Vulnerability

CVE-2025-58778 Overview

CVE-2025-58778 affects multiple versions of the Ruijie Networks RG-EST300 wireless bridge. The device ships with an undocumented Secure Shell (SSH) server enabled in its initial configuration. The SSH service is not mentioned in the product manual, and it accepts logins from anyone who possesses the associated credentials. An authenticated attacker can read sensitive information, modify system settings, or trigger a denial of service (DoS) condition on the device. The issue is classified as CWE-912: Hidden Functionality.

Critical Impact
An undocumented SSH service in the default configuration allows credential-holding attackers to access RG-EST300 devices over the network and compromise confidentiality, integrity, and availability.

Affected Products

Ruijie Networks RG-EST300 (multiple firmware versions)
Devices shipped with the default initial configuration
Deployments exposing the RG-EST300 management plane to untrusted networks

Discovery Timeline

2025-10-16 - CVE-2025-58778 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in the NVD database

Technical Details for CVE-2025-58778

Vulnerability Analysis

The RG-EST300 exposes an SSH server that is not described in any user-facing documentation. The service is active out of the box, so administrators have no reason to disable or harden it. Anyone aware of the embedded credentials can authenticate to the device through standard SSH clients. Once authenticated, an attacker gains a privileged shell-like interface that allows reading configuration data, modifying device parameters, and disrupting service. The vulnerability falls under CWE-912: Hidden Functionality, which covers undocumented features that bypass intended security controls.

Root Cause

The root cause is an insecure default configuration combined with hidden functionality. The vendor enabled the SSH daemon in the factory image without documenting it or requiring administrators to set unique credentials at first boot. Because the service is undocumented, operators cannot apply standard hardening procedures such as disabling unused daemons or rotating built-in accounts.

Attack Vector

The attack vector is network-based. An attacker who can reach the device on its SSH port and who knows or obtains the associated credentials can authenticate remotely. Exploitation does not require user interaction. After login, the attacker can disclose information stored on the device, alter operational settings, or render the bridge unavailable. The Exploit Prediction Scoring System (EPSS) probability is approximately 0.54% (percentile 40.76) as of 2026-06-15.

No verified public exploit code is available. Refer to the JVN Security Advisory and the Ruijie Security Announcement for vendor-supplied technical context.

Detection Methods for CVE-2025-58778

Indicators of Compromise

Inbound SSH sessions (TCP/22) to RG-EST300 management interfaces from non-administrative sources.
Configuration changes on the device that do not correlate with any authorized administrator session in the management console.
Unexpected device reboots, loss of connectivity, or service interruptions consistent with DoS activity.

Detection Strategies

Audit network traffic for SSH connections directed at RG-EST300 IP addresses, especially from outside the management VLAN.
Correlate SSH authentication events on adjacent jump hosts and firewalls with device configuration changes.
Run network discovery scans to enumerate RG-EST300 units that are listening on TCP/22 and flag any that should not be reachable.

Monitoring Recommendations

Forward firewall and switch logs covering the RG-EST300 management subnet to a centralized logging or SIEM platform.
Alert on first-seen SSH client source addresses connecting to RG-EST300 devices.
Track changes to device configuration baselines and notify on unexpected drift.

How to Mitigate CVE-2025-58778

Immediate Actions Required

Restrict network access to RG-EST300 devices so that only authorized management hosts can reach TCP/22.
Place affected devices behind a firewall or in an isolated management VLAN until vendor guidance is applied.
Review the Ruijie Security Announcement and the JVN Security Advisory for the current list of fixed versions and remediation steps.
Check the Ruijie Product Lifecycle Support page to confirm whether your hardware is still receiving updates.

Patch Information

Ruijie Networks has published an advisory addressing CVE-2025-58778. Administrators should consult the vendor advisory for firmware versions that disable or harden the undocumented SSH service and apply the fixed release to every affected RG-EST300 unit. Devices that have reached end of support per the lifecycle page should be replaced.

Workarounds

Block TCP/22 to RG-EST300 devices at the upstream firewall or switch access control list (ACL) until a fixed firmware is installed.
Segment RG-EST300 deployments onto a dedicated management network unreachable from user or guest VLANs.
Rotate any shared administrative credentials used on the device and audit logs for prior SSH access.

bash

# Example ACL restricting SSH access to RG-EST300 devices
# Replace 10.10.0.0/24 with your authorized management subnet
# and 192.0.2.10 with the device IP
access-list 100 permit tcp 10.10.0.0 0.0.0.255 host 192.0.2.10 eq 22
access-list 100 deny   tcp any host 192.0.2.10 eq 22
access-list 100 permit ip any any