CVE-2023-3450

What it actually does

CVE-2023-3450 is an operating system command injection vulnerability in the Network Diagnostic Page of Ruijie RG-BCR860 firmware version 2.5.13. A remote attacker with high-privileged access to the device management interface can manipulate diagnostic input that is passed to the underlying operating system without proper sanitization. Successful exploitation allows arbitrary OS commands to run in the context of the device’s web or diagnostic process, potentially leading to full compromise of the appliance, including configuration theft, traffic interception, firmware tampering, or service disruption.

Why it matters to the business

Compromise of an edge or network routing appliance can expose sensitive network configuration, credentials, routing information, and traffic paths, and may allow attackers to use the device as a foothold for broader internal access. The vulnerability has public exploit information available and a high EPSS score, increasing the likelihood of opportunistic scanning or targeted use against exposed management interfaces. Because no fixed version is listed and the vendor reportedly did not respond to disclosure, organizations may need to rely on compensating controls, isolation, or device replacement rather than a simple patch.

How an attack unfolds

An attacker first identifies a Ruijie RG-BCR860 device with its administrative management interface reachable over the network. Because the CVSS vector requires high privileges, the attacker either authenticates with legitimate administrative credentials, uses stolen credentials, or chains this issue after gaining privileged access through another weakness. The attacker then accesses the Network Diagnostic Page, which commonly accepts values such as hostnames or IP addresses for ping, traceroute, or similar tests. By appending shell metacharacters and commands to a diagnostic input field, the attacker causes the device to execute attacker-controlled operating system commands. After command execution is achieved, the attacker may enumerate the appliance, dump configuration files, retrieve credentials or keys, alter routing or firewall settings, install persistence where possible, stage malware or scripts, or use the device as a pivot point into adjacent networks.

How to fix it

No fixed version is currently provided in the available vulnerability data. Treat Ruijie RG-BCR860 firmware 2.5.13 as vulnerable. Immediately restrict access to the management interface to trusted administrative networks only, preferably through a VPN or dedicated out-of-band management network. Block management access from the internet and untrusted internal segments. Enforce strong, unique administrative credentials and multi-factor authentication if supported. Review and remove unnecessary administrative accounts. Disable or limit use of the Network Diagnostic Page if the product permits it. Monitor the vendor for updated firmware; if no supported fixed release is available, plan replacement or decommissioning of affected devices. Where feasible, place compensating controls such as firewall ACLs, reverse proxy filtering, network segmentation, and outbound egress restrictions around the appliance.

How to confirm the fix worked

Confirm whether any Ruijie RG-BCR860 devices are running firmware version 2.5.13. Verify that management interfaces are not reachable from the public internet or untrusted networks. Attempt authenticated testing in a controlled maintenance window using benign command-injection payloads that do not alter the device, such as harmless command separators followed by an idempotent command or timing test, and confirm that injected commands do not execute. Review firewall rules to ensure only approved administrator source addresses can reach the management service. Validate that administrative passwords were rotated after remediation and that no unexpected admin accounts exist. If replacement or firmware update is performed, record the new firmware version and retest the Network Diagnostic Page behavior.

Typical attack path

1. Discover an exposed Ruijie RG-BCR860 management interface through scanning, asset inventory leakage, or targeted reconnaissance.
2. Obtain high-privileged access to the management interface through valid credentials, credential theft, password reuse, or another vulnerability.
3. Navigate to the Network Diagnostic Page used for ping, traceroute, or similar network tests.
4. Submit crafted diagnostic input containing shell metacharacters and attacker-controlled commands.
5. Confirm command execution through command output, timing behavior, DNS callbacks, or outbound network connections.
6. Run reconnaissance commands on the appliance to identify firmware, interfaces, routes, users, credentials, and configuration files.
7. Modify configuration, exfiltrate sensitive data, deploy scripts or tooling, or use the appliance as a foothold for lateral movement.
8. Attempt to hide activity by clearing logs, changing timestamps, or reverting visible configuration changes.

How to detect it

Review management interface access logs, web server logs on the appliance if available, firewall logs, VPN logs, AAA/RADIUS/TACACS authentication logs, configuration change records, and network flow data. Look for administrative logins from unusual source IPs, unexpected use of the Network Diagnostic Page, requests containing shell metacharacters, or diagnostic inputs that include commands rather than simple IP addresses or hostnames. Investigate outbound connections from the appliance to unfamiliar external IPs or domains, especially HTTP, HTTPS, DNS, ICMP, or unusual high ports shortly after diagnostic page access. Examine configuration exports for unauthorized administrator accounts, modified DNS or routing settings, new startup scripts, altered firewall rules, or suspicious remote management changes. If the appliance supports shell or process logging, look for execution of utilities such as sh, bash, wget, curl, nc, netcat, telnet, tftp, busybox, chmod, or attempts to download and execute scripts. Since public exploit information is available, also search perimeter telemetry for scanning or repeated authenticated requests to diagnostic functionality across multiple devices.

• ;wget
• ; curl
• |wget
• | curl
• && wget
• && curl
• `wget
• `curl
• $(wget
• $(curl
• /bin/sh -c
• /bin/bash -c
• busybox wget
• busybox nc
• nc -e /bin/sh
• netcat -e /bin/sh
• chmod +x /tmp/
• /tmp/;
• /var/tmp/;
• tftp -g
• Network Diagnostic
• ping;
• traceroute;
• nslookup;
• ; cat /etc/passwd
• ; id
• ; uname -a

What your security team should do

• Inventory all Ruijie RG-BCR860 appliances and identify devices running firmware version 2.5.13.
• Immediately remove internet exposure for all device management interfaces and restrict access to trusted administrative networks only.
• Rotate all administrative credentials for affected appliances, especially if the interface was exposed or shared credentials were used.
• Review recent administrative logins, configuration changes, and diagnostic page usage for suspicious activity.
• Apply a vendor firmware update if one becomes available; if none is available, escalate replacement or decommissioning as a risk decision.
• Implement network egress controls so appliances cannot freely reach arbitrary external hosts for wget, curl, DNS callbacks, reverse shells, or command-and-control traffic.
• Add SIEM detections for shell metacharacters and command-execution patterns in requests to network diagnostic functionality.
• Back up known-good configurations, compare current configurations against baselines, and investigate unexpected changes.
• Segment these devices from sensitive internal networks to reduce pivoting risk if compromised.
• Because public exploit information exists and EPSS is high, prioritize remediation ahead of lower-likelihood authenticated appliance issues.