CVE-2025-34057
Ruijie NBR Router Administrative Credential Disclosure
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Ruijie NBR Router Administrative Credential Disclosure
An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR1000 models) via the /WEB_VMS/LEVEL15/ endpoint. By crafting a specific POST request with modified Cookie headers and specially formatted parameters, an unauthenticated attacker can retrieve administrative account credentials in plaintext. This flaw allows direct disclosure of sensitive user data due to improper authentication checks and insecure backend logic.
Reserved 2025-04-15 | Published 2025-07-02 | Updated 2025-07-02 | Assigner VulnCheckCWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-306 Missing Authentication for Critical Function
www.seebug.org/vuldb/ssvid-89107
vulners.com/seebug/SSV:89107
vulncheck.com/...router-administrative-credential-disclosure
Support options
