The cybersecurity field faced a critical development recently when Claroty’s Team82 unveiled ten vulnerabilities in Ruijie Networks’ Reyee cloud management platform and associated network devices. Ruijie Networks, a major provider of networking devices and cloud services, caters to a global audience including airports, shopping malls, and other public places. Of significant concern is that these vulnerabilities could enable malicious actors to execute code on cloud-enabled devices, potentially leading to unauthorized control over numerous devices. This situation presents security threats to enterprises, educational institutions, government organizations, and service providers across more than 90 countries.
Particularly alarming in the discovery is a technique referred to as the "Open Sesame" attack method. Through this method, an attacker in close proximity could exploit leaked identifiers from Ruijie access points, allowing them to execute arbitrary code and gain access to the network. The attack involves sniffing beacon messages to leak the serial number of the device. Following this, the attacker can exploit flaws in the MQTT communication protocol to send malicious commands from what appears to be a cloud-based source. This method illustrates how sophisticated and determined malicious actors can be in undermining network security, emphasizing the need for continuous vigilance and advanced defensive measures.
In an immediate response to these findings, Ruijie Networks upgraded its cloud infrastructure to address the vulnerabilities discovered by Team82. Remarkably, the update was implemented in a manner that required no action from users, showcasing Ruijie’s commitment to ensuring the security of their widely used networking devices. This prompt action is crucial in mitigating risks and reinforcing the trust placed in them by various public and private sector entities. Users can continue to rely on Ruijie Networks, assured that their security measures are in place and effective against potential threats. However, this incident also serves as a stark reminder of the ever-present risks in our increasingly interconnected digital environment.