CVE-2023-3450

This flaw lets someone who has login access reach a special “Network Diagnostic” screen and use it to make the device run attacker-chosen commands. Think of it like a maintenance panel on your equipment that’s supposed to only do safe checks—but in this case, it can be turned into a way to control the device itself. That can lead to disruption or unwanted changes to how the device operates.

This matters if you use or administer a Ruijie RG-BCR860 network device (including its firmware) and the device’s “Network Diagnostic Page” can be reached over the network by someone who has valid credentials. The vulnerability requires authentication, and it can be triggered remotely over the network. The risk is mainly when the diagnostic page is reachable from a network an attacker can access (for example, not properly restricted) and they can log in.

Treat this as urgent enough to act now on exposure control, because there is a public proof-of-concept and an attacker with network access and valid credentials can run arbitrary commands. There is no confirmed vendor patch information available yet, so reducing who can reach the diagnostic functionality is your immediate priority. This is rated AMBER for overall risk, meaning it’s not “ignore until later,” but it’s also not the highest “critical day-one” category.

Confirm whether you’re affected

1. Identify device model and firmware version: On each Ruijie RG-BCR860, check the currently installed firmware version.
2. Compare to known affected version: This issue is reported for Ruijie RG-BCR860 firmware 2.5.13.

Check reachability and exposure

3. Verify network exposure of the Network Diagnostic Page: Determine from where the device’s web/admin interface (including the Network Diagnostic Page) is reachable.
   • If it’s accessible from the internet or from untrusted networks/subnets, you should assume it’s reachable by more people than intended.
4. Check credential scope: Identify all user accounts that can access the diagnostic/administrative functions, and remove any that are not needed.

Immediate mitigation while waiting for a fix

5. Restrict access at the perimeter: Allow access to the device management/diagnostic interface only from trusted IP addresses or via a VPN, and block all other traffic to that interface.
6. Harden account access: Remove unused accounts and ensure only necessary administrators have valid credentials.

Patch/upgrade status

7. No fixed version identified yet: Based on the available findings, no patch or fixed firmware version is currently known for CVE-2023-3450. Open a support case with Ruijie and request the patched firmware build (or an official mitigation/configuration guidance) for this CVE.

What to monitor

8. Look for suspicious admin/diagnostic activity: Review device logs (web/admin access logs and any system command or diagnostic-related logs if available) for unusual use of the Network Diagnostic Page, especially at times when no maintenance was scheduled.

KEV / timeline

9. CISA KEV status: This CVE is not listed in CISA KEV, so there isn’t a CISA “known exploited” timeline to follow based on the provided findings.

CVE-2023-3450 is a CWE-78 (OS command injection) issue in the Ruijie RG-BCR860 “Network Diagnostic Page.” The findings indicate that an attacker with network access and valid credentials can trigger the weakness to execute arbitrary commands on the device. A public proof-of-concept exists (weaponization is publicly available), but no CISA KEV listing is reported in the findings, and no official patch/fixed version information is available yet. The overall risk is assessed as AMBER, and the attack likelihood prediction is noted as falling trend; however, because KEV is not listed, this remains an observed/probable risk rather than confirmed CISA “in-the-wild” exploitation.