Ruijie NBR Router Administrative Credential Disclosure

published 2025-07-02 16 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-19723

cvss: 8.7; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 10.1%; EPSS 10.1% chance of exploitation in 30 days, percentile 95%
public exploits: 0; none known

An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR1000 models) via the /WEB_VMS/LEVEL15/ endpoint. By crafting a specific POST request with modified Cookie headers and specially formatted parameters, an unauthenticated attacker can retrieve administrative account credentials in plaintext. This flaw allows direct disclosure of sensitive user data due to improper authentication checks and insecure backend logic. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 16 mo ago (2025-07-02)

Exploit prediction

10.15% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

seebug.org https://www.seebug.org/vuldb/ssvid-89107 referenced PoC, tagged "exploit" by a source, unverified
vulners.com https://vulners.com/seebug/SSV:89107 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Ruijie NBR Router

Classification

Weakness

CWE-306 Missing Authentication for Critical Functionality

References

seebug.org /vuldb/ssvid-89107
exploit
vulners.com /seebug/SSV:89107
exploit
vulncheck.com /advisories/ruijie-nbr-router-administrative-credential-disclosure
third-party-advisory

Sources

CVE List CVE-2025-34057
NVD CVE-2025-34057

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary