cve-2025-34057

HIGH CVSS 8.7 opencve

Description

An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR1000 models) via the /WEB_VMS/LEVEL15/ endpoint. By crafting a specific POST request with modified Cookie headers and specially formatted parameters, an unauthenticated attacker can retrieve administrative account credentials in plaintext. This flaw allows direct disclosure of sensitive user data due to improper authentication checks and insecure backend logic. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

Timeline

Published: 2025-07-02 14:15 UTC
Last Modified: 2026-06-17

CVSS Details

CVSS details not available.

Affected Products

No product information available.

Weaknesses (CWE)

CWE-306 CWE-200

CVSS metrics

Version	Base	Severity	Vector	Source
4.0	8.7	HIGH	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`	mitre
4.0	8.7	HIGH	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`	nvd
4.0	8.7	HIGH	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`	opencve

References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "advisories": [
    {
      "id": "EUVD-2025-19723",
      "source": "euvd",
      "title": "An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR1000 models) via the /WEB_VMS/LEVEL15/ endpoint. By crafting a specific POST request with modified Cookie headers and specially formatted parameters, an unauthenticated attacker can retrieve administrative account credentials in plaintext. This flaw allows direct disclosure of sensitive user data due to improper authentication checks and insecure backend logic.",
      "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-19723"
    }
  ],
  "cve": "CVE-2025-34057",
  "epss": {
    "score": 0.08692
  },
  "mitre": {
    "cpes": [],
    "created": "2025-07-02T13:43:52.935000+00:00",
    "description": "An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR1000 models) via the /WEB_VMS/LEVEL15/ endpoint. By crafting a specific POST request with modified Cookie headers and specially formatted parameters, an unauthenticated attacker can retrieve administrative account credentials in plaintext. This flaw allows direct disclosure of sensitive user data due to improper authentication checks and insecure backend logic. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {
        "score": 8.7,
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
      }
    },
    "mitre_repo_path": "cves/2025/34xxx/CVE-2025-34057.json",
    "references": [
      "https://vulncheck.com/advisories/ruijie-nbr-router-administrative-credential-disclosure",
      "https://vulners.com/seebug/SSV:89107",
      "https://www.seebug.org/vuldb/ssvid-89107"
    ],
    "title": "Ruijie NBR Router Administrative Credential Disclosure",
    "updated": "2025-11-13T19:08:30.586000+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-306"
    ]
  },
  "nvd": {
    "cpes": [],
    "created": "2025-07-02T14:15:24.090000+00:00",
    "description": "An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR1000 models) via the /WEB_VMS/LEVEL15/ endpoint. By crafting a specific POST request with modified Cookie headers and specially formatted parameters, an unauthenticated attacker can retrieve administrative account credentials in plaintext. This flaw allows direct disclosure of sensitive user data due to improper authentication checks and insecure backend logic. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {
        "score": 8.7,
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
      }
    },
    "nvd_repo_path": "2025/CVE-2025-34057.json",
    "references": [
      "https://vulncheck.com/advisories/ruijie-nbr-router-administrative-credential-disclosure",
      "https://vulners.com/seebug/SSV:89107",
      "https://www.seebug.org/vuldb/ssvid-89107"
    ],
    "title": null,
    "updated": "2026-06-17T09:13:23.747000+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-306"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2025-07-02T14:00:00+00:00",
        "data": [
          {
            "details": {
              "new": "An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR1000 models) via the /WEB_VMS/LEVEL15/ endpoint. By crafting a specific POST request with modified Cookie headers and specially formatted parameters, an unauthenticated attacker can retrieve administrative account credentials in plaintext. This flaw allows direct disclosure of sensitive user data due to improper authentication checks and insecure backend logic.",
              "old": null
            },
            "type": "description"
          },
          {
            "details": {
              "new": "Ruijie NBR Router Administrative Credential Disclosure",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-200",
                "CWE-306"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": [
                "https://vulncheck.com/advisories/ruijie-nbr-router-administrative-credential-disclosure",
                "https://vulners.com/seebug/SSV:89107",
                "https://www.seebug.org/vuldb/ssvid-89107"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV4_0": {
                  "score": 8.7,
                  "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "1647f48f-ec16-4bc7-ac1d-32709bdd3537"
      },
      {
        "created": "2025-07-02T21:15:00+00:00",
        "data": [
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "no",
                    "Exploitation": "poc",
                    "Technical Impact": "partial"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "92c7cefa-dd2d-407a-9908-4db65b361920"
      },
      {
        "created": "2025-11-13T19:30:00+00:00",
        "data": [
          {
            "details": {
              "new": "An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR1000 models) via the /WEB_VMS/LEVEL15/ endpoint. By crafting a specific POST request with modified Cookie headers and specially formatted parameters, an unauthenticated attacker can retrieve administrative account credentials in plaintext. This flaw allows direct disclosure of sensitive user data due to improper authentication checks and insecure backend logic. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.",
              "old": "An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR1000 models) via the /WEB_VMS/LEVEL15/ endpoint. By crafting a specific POST request with modified Cookie headers and specially formatted parameters, an unauthenticated attacker can retrieve administrative account credentials in plaintext. This flaw allows direct disclosure of sensitive user data due to improper authentication checks and insecure backend logic."
            },
            "type": "description"
          }
        ],
        "id": "733cd6c4-14fe-45c8-b07d-6dbb2462244e"
      },
      {
        "created": "2025-11-13T20:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [],
              "removed": [
                "CWE-200"
              ]
            },
            "type": "weaknesses"
          }
        ],
        "id": "0c1f41e7-fafe-454d-8855-1b1cd1eb0ccb"
      }
    ],
    "cpes": {
      "data": [],
      "providers": []
    },
    "created": {
      "data": "2025-07-02T13:43:52.935000+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR1000 models) via the /WEB_VMS/LEVEL15/ endpoint. By crafting a specific POST request with modified Cookie headers and specially formatted parameters, an unauthenticated attacker can retrieve administrative account credentials in plaintext. This flaw allows direct disclosure of sensitive user data due to improper authentication checks and insecure backend logic. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {},
        "provider": null
      },
      "cvssV4_0": {
        "data": {
          "score": 8.7,
          "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
        },
        "provider": "mitre"
      },
      "epss": {
        "data": {
          "score": 0.08692
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "no",
            "Exploitation": "poc",
            "Technical Impact": "partial"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://vulncheck.com/advisories/ruijie-nbr-router-administrative-credential-disclosure",
        "https://vulners.com/seebug/SSV:89107",
        "https://www.seebug.org/vuldb/ssvid-89107"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": "Ruijie NBR Router Administrative Credential Disclosure",
      "provider": "mitre"
    },
    "updated": {
      "data": "2026-04-15T00:35:42.020000+00:00",
      "provider": "nvd"
    },
    "vendors": {
      "data": [],
      "providers": []
    },
    "weaknesses": {
      "data": [
        "CWE-306"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    }
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2025-07-02T13:43:52.935000+00:00",
    "description": "An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR1000 models) via the /WEB_VMS/LEVEL15/ endpoint. By crafting a specific POST request with modified Cookie headers and specially formatted parameters, an unauthenticated attacker can retrieve administrative account credentials in plaintext. This flaw allows direct disclosure of sensitive user data due to improper authentication checks and insecure backend logic. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "no",
          "Exploitation": "poc",
          "Technical Impact": "partial"
        },
        "version": "2.0.3"
      }
    },
    "references": [],
    "title": "Ruijie NBR Router Administrative Credential Disclosure",
    "updated": "2025-07-02T20:24:22.117000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2025/34xxx/CVE-2025-34057.json",
    "weaknesses": []
  }
}

cve-2025-34057

Raw JSON Data