What is the CVSS score of CVE-2023-48849?

CVE-2023-48849 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.3%.

Is there a public PoC exploit available for CVE-2023-48849?

Yes, a public proof-of-concept exploit is available for CVE-2023-48849. Prioritise patching immediately. EPSS: 1.3%.

Rg Eg1000C Firmware CVE-2023-48849

CRITICAL

2023-12-06 cve@mitre.org

RCE Rg Eg1000C Firmware Rg Eg1000E Firmware Rg Eg105G Firmware Rg Eg105G V2 Firmware Rg Eg105G E Firmware Rg Eg105G P Firmware Rg Eg105G Pe Firmware Rg Eg105Gw T Firmware Rg Eg105Gw X Firmware Rg Eg2000Ce Firmware Rg Eg209Gs Firmware Rg Eg2100 P Firmware Rg Eg210G E Firmware Rg Eg210G P Firmware Rg Eg210G Pe Firmware Rg Eg3000Eu Firmware Rg Eg3000Xe Firmware Rg Eg305Gh P E Firmware Rg Eg310Gh E Firmware Rg Eg3230 Firmware Rg Eg3250 Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Dec 06, 2023 - 08:15 nvd

CRITICAL 9.8

DescriptionNVD

Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to incorrect filtering.

AnalysisAI

Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to incorrect filtering. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to incorrect filtering. Affected products include: Ruijie Rg-Eg1000C Firmware, Ruijie Rg-Eg1000E Firmware, Ruijie Rg-Eg105G Firmware, Ruijie Rg-Eg105G V2 Firmware, Ruijie Rg-Eg105G-E Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.