CVE-2024-28288

Published: Mar 30, 2024Modified: Jun 30, 2025

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrator password reset vulnerability. An attacker can use this vulnerability to log in to the device and disrupt the business of the enterprise.

Affected (1)

Products: Ruijie: Rg Nbr700gw Firmware

1 product

Rg Nbr700gw Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ruijie Rg Nbr700gw Firmware	Version 10.3(4b12)

Running on/with	Platform Versions
Ruijie Rg Nbr700gw	All versions

Related CWEs

Reliance on Cookies without Validation and Integrity Checking

The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

References (4)

https://github.com/adminquit/CVE-2024-28288/blob/d8223c6d45af877669c27fa0a95adfe51924fa86/CVE-2024-28288/CVE-2024-28288.md

Source: cve@mitre.org

Broken Link

https://pan.baidu.com/s/1H4J_eA6wSCnDEsUSAWIzsg?pwd=CVE1

Source: cve@mitre.org

Broken Link

https://github.com/adminquit/CVE-2024-28288/blob/d8223c6d45af877669c27fa0a95adfe51924fa86/CVE-2024-28288/CVE-2024-28288.md

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://pan.baidu.com/s/1H4J_eA6wSCnDEsUSAWIzsg?pwd=CVE1

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

Timeline

No history available yet.