CVE-2023-4169: Ruijie RG-EW1200G router password endpoint improper access control

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 8.8 with public exploit code and very high EPSS, but exploitation requires low privileges and no KEV listing, so it is high rather than critical.

What it is

The Ruijie RG-EW1200G firmware 1.0(1)B1P5 exposes the /api/sys/set_passwd administrator password handler without proper access control, allowing a remote attacker to change the admin password. The vendor did not respond to the disclosure, so no fixed firmware is known and the flaw is publicly exploitable.

Impact

An attacker can rewrite the administrator password and take over the device's management interface, gaining full control of the router's configuration and traffic handling.

Attack surface

Reachable over the network via the web API endpoint /api/sys/set_passwd; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N), so the attacker needs some authenticated or low-privilege access to the device interface.

Exploitation

A public exploit is referenced on GitHub, EPSS is 0.4923 (98.8th percentile), and the CVE is not listed in CISA KEV, indicating active public exploit code but no confirmed widespread exploitation.

What to do

• Apply any vendor firmware update for RG-EW1200G if one becomes available; the vendor did not respond to the disclosure, so confirm with Ruijie support.
• If no patch exists, restrict access to the router's web management interface to trusted networks only and disable remote/WAN administration.
• Change default administrator credentials and enforce strong unique passwords on all management accounts.
• Segment or isolate the router from sensitive networks and monitor for unauthorized configuration changes.
• Consider replacing the device if the vendor remains unresponsive and no fix is provided.

Detection

• Monitor router and web logs for POST requests to /api/sys/set_passwd, especially from unexpected source IPs.
• Alert on administrator password change events or authentication failures followed by successful logins.
• Watch for configuration changes or new admin accounts on RG-EW1200G devices outside change windows.
• Use network monitoring to detect management interface access from untrusted or external networks.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.