CVE-2023-4415: Ruijie RG-EW1200G login endpoint improper authentication

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote improper authentication with a public exploit and very high EPSS, but no confirmed in-the-wild exploitation or KEV listing and no vendor patch.

What it is

The Ruijie RG-EW1200G firmware (07161417 r483) has an improper authentication flaw in the /api/sys/login endpoint. An attacker can bypass or subvert the login check, and a public exploit has been disclosed. The vendor was contacted but did not respond, so no fixed version is identified in this record.

Impact

An attacker gains authenticated-level access to the device's management API, with high impact to confidentiality, integrity and availability per the CVSS vector. This can lead to full device compromise and control of the network it serves.

Attack surface

Reachable remotely over the network via the /api/sys/login HTTP endpoint. The CVSS vector requires low privileges (PR:L) and no user interaction (UI:N), so some credential or session context is needed before the flaw is triggered.

Exploitation

A public exploit exists and is referenced by an Exploit-tagged third-party advisory. The CVE is not in CISA KEV, but EPSS is high at roughly 0.58 (99th percentile), indicating elevated likelihood of exploitation.

What to do

• Apply the latest Ruijie firmware for RG-EW1200G if/when the vendor publishes a fix; the vendor did not respond to the disclosure, so verify availability directly.
• If no patch exists, restrict management access to the /api/sys/login endpoint to trusted networks only and disable remote/WAN administration.
• Place the device behind a firewall or management VLAN and block external access to its web/API interface.
• Rotate any credentials and secrets stored on or managed through the device, and monitor for unauthorized configuration changes.
• Consider replacing or isolating the device if the vendor remains unresponsive and no fix is available.

Detection

• Monitor HTTP requests to /api/sys/login for anomalous patterns, repeated attempts, or unexpected source IPs.
• Alert on successful logins or API calls from external or untrusted networks to the device management interface.
• Review device logs and configuration for unauthorized changes or new admin accounts.
• Track outbound or lateral traffic from the device that could indicate it has been co-opted.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.