SecuriTricks - CVE-2023-53881

Description

ReyeeOS 1.204.1614 contains an unencrypted CWMP communication vulnerability that allows attackers to intercept and manipulate device communication through a man-in-the-middle attack. Attackers can create a fake CWMP server to inject and execute arbitrary commands on Ruijie Reyee Cloud devices by exploiting the unprotected HTTP polling requests.

Product(s) Impacted

Vendor	Product	Versions
Ruijienetworks	Reyee Os	1.204.1614

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-319

Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
o	ruijienetworks	reyee_os	1.204.1614	/	/	/	/	/	/	/

References

https://ruijienetworks.com

https://www.exploit-db.com/exploits/51642

https://www.vulncheck.com/advisories/reyeeos-man-in-the-middle-remote-code-execution-via-cwmp

CVSS Score

9.2 / 10

CVSS Data - 4.0

Attack Vector: NETWORK
Attack Complexity: HIGH
Attack Requirements: NONE
Privileges Required: NONE
User Interaction: NONE
Scope:
Confidentiality Impact: HIGH
Integrity Impact: HIGH
Availability Impact: HIGH
Exploit Maturity: NOT_DEFINED

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

View Vector String

Timeline

Published: Dec. 15, 2025, 9:15 p.m.
Last Modified: Dec. 18, 2025, 10:38 p.m.

Status : Analyzed

CVE has had analysis completed and all data associations made.

More info

Source

disclosure@vulncheck.com

CVE-2023-53881