CVE-2025-34057

HIGH EXPLOITED

Ruijie NBR Router - Unauthenticated Administrative Credential Disclosure via /WEB_VMS/LEVEL15/ Endpoint

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2025-34057 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR1000 models) via the /WEB_VMS/LEVEL15/ endpoint. By crafting a specific POST request with modified Cookie headers and specially formatted parameters, an unauthenticated attacker can retrieve administrative account credentials in plaintext. This flaw allows direct disclosure of sensitive user data due to improper authentication checks and insecure backend logic. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

References (3)

Core 3
Core References
Various Sources exploit
https://vulners.com/seebug/SSV:89107

Scores

CVSS v4 8.7
EPSS 0.0644
EPSS Percentile 92.8%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

VulnCheck KEV 2025-07-02
CWE
CWE-306
Status published
Products (1)
Ruijie/NBR Router
Published Jul 02, 2025
Tracked Since Feb 18, 2026