CVE-2021-43162

HighCVSS 8.8/10Last modified Jul 9, 2026

Description

A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the runPackDiagnose function in /cgi-bin/luci/api/diagnose.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://seclists.org/fulldisclosure/2022/May/0Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2022/May/0Mailing List, Third Party Advisory

Timeline

Published: May 4, 2022
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-431639.8A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 CVE-2021-431648.8A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 CVE-2021-43178.8Use after free in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to perform arbitrary read/write via a crafted HTML CVE-2021-431716.5Improper verification of applications' cryptographic signatures in the /e/OS app store client App Lounge before 0.19q allows attackers in co CVE-2021-431727.5NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validat CVE-2021-431737.5In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly dr CVE-2021-431747.5NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. This en CVE-2021-431757.5The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action th CVE-2021-431768.8The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file exten CVE-2021-431775.3As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Passw CVE-2021-43188.8Object corruption in Blink in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit object corruption via a c CVE-2021-431807.5In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible.