📄 Description (English)
Ruijie Networks Switch eWeb S29_RGOS 11.4 contains a directory traversal vulnerability that allows unauthenticated attackers to access sensitive configuration files by manipulating file path parameters. Attackers can exploit the /download.do endpoint with '../' sequences to retrieve system configuration files containing credentials and network settings.
🤖 AI Executive Summary
CVE-2020-37015 is a critical directory traversal vulnerability in Ruijie Networks Switch eWeb S29_RGOS 11.4 that allows unauthenticated attackers to access sensitive configuration files containing credentials and network settings through the /download.do endpoint. The vulnerability exploits improper input validation on file path parameters, enabling attackers to bypass access controls without authentication. This poses significant risk to organizations using Ruijie network infrastructure, particularly in Saudi Arabia where Ruijie equipment is deployed in enterprise and government networks.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: Apr 30, 2026 03:49
🇸🇦 Saudi Arabia Impact Assessment
This vulnerability poses severe risk to Saudi critical infrastructure sectors: (1) Banking & Financial Services — SAMA-regulated institutions using Ruijie switches for network infrastructure face credential exposure and potential lateral movement; (2) Government & Defense — NCA-supervised entities and government networks utilizing Ruijie equipment are at risk of unauthorized access to classified network configurations; (3) Energy Sector — ARAMCO and energy companies relying on Ruijie network infrastructure could experience operational technology network compromise; (4) Telecommunications — STC and other telecom operators using Ruijie switches in core network infrastructure face service disruption and data breach risks; (5) Healthcare — MOHSR-regulated hospitals and healthcare facilities using Ruijie equipment for network segmentation could lose isolation controls. The unauthenticated nature of the exploit makes this particularly dangerous as it requires no prior system access.
🏢 Affected Saudi Sectors
Banking & Financial Services
Government & Defense
Energy & Utilities
Telecommunications
Healthcare
Critical Infrastructure
🎯 MITRE ATT&CK Techniques
⚖️ Saudi Risk Score (AI)
8.2
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Identify all Ruijie Networks Switch eWeb S29_RGOS 11.4 devices in your network using network scanning tools and asset inventory systems
2. Isolate affected devices from untrusted networks and restrict access to the /download.do endpoint using firewall rules
3. Implement network segmentation to limit access to management interfaces to authorized administrative networks only
4. Change all credentials stored in configuration files immediately and rotate SSH/SNMP community strings
5. Review access logs for the /download.do endpoint for indicators of exploitation (requests containing '../' sequences)
PATCHING GUIDANCE:
1. Apply the latest firmware patch from Ruijie Networks immediately — verify patch availability for your specific model variant
2. Test patches in a non-production environment before deployment
3. Schedule maintenance windows for firmware updates with minimal network impact
COMPENSATING CONTROLS (if patch unavailable):
1. Implement Web Application Firewall (WAF) rules to block requests containing '../' or URL-encoded equivalents (%2e%2e%2f) to the /download.do endpoint
2. Restrict HTTP/HTTPS access to management interfaces using IP whitelisting at the firewall level
3. Disable the /download.do endpoint if not required for operations
4. Implement strict rate limiting on management interface access
DETECTION RULES:
1. Monitor for HTTP requests to /download.do containing '../' or encoded traversal sequences
2. Alert on any unauthenticated access attempts to management interfaces
3. Track configuration file access patterns and flag unusual file downloads
4. Monitor for failed authentication followed by successful /download.do requests
5. Implement IDS/IPS signatures for directory traversal attempts on Ruijie devices
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. تحديد جميع أجهزة Ruijie Networks Switch eWeb S29_RGOS 11.4 في شبكتك باستخدام أدوات المسح والجرد
2. عزل الأجهزة المتأثرة عن الشبكات غير الموثوقة وتقييد الوصول إلى نقطة النهاية /download.do باستخدام قواعد جدار الحماية
3. تنفيذ تقسيم الشبكة لتحديد الوصول إلى واجهات الإدارة للشبكات الإدارية المصرح بها فقط
4. تغيير جميع بيانات الاعتماد المخزنة في ملفات التكوين فوراً وتدوير سلاسل SNMP/SSH
5. مراجعة سجلات الوصول لنقطة النهاية /download.do للبحث عن مؤشرات الاستغلال
إرشادات التصحيح:
1. تطبيق أحدث تصحيح البرامج الثابتة من Ruijie Networks فوراً
2. اختبار التصحيحات في بيئة غير الإنتاج قبل النشر
3. جدولة نوافذ الصيانة لتحديثات البرامج الثابتة
عناصر التحكم البديلة:
1. تنفيذ قواعد جدار تطبيقات الويب لحظر الطلبات التي تحتوي على '../'
2. تقييد الوصول إلى واجهات الإدارة باستخدام القوائم البيضاء للعناوين
3. تعطيل نقطة النهاية /download.do إذا لم تكن مطلوبة
4. تنفيذ تحديد معدل صارم على الوصول إلى واجهة الإدارة
قواعد الكشف:
1. مراقبة طلبات HTTP إلى /download.do التي تحتوي على '../'
2. تنبيهات محاولات الوصول غير المصرح بها
3. تتبع أنماط الوصول إلى ملفات التكوين
4. مراقبة الفشل المصادقة متبوعة بطلبات /download.do الناجحة
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
A.5.1.1 - Information security policies and procedures
A.6.1.1 - Access control policy
A.6.2.1 - User registration and access rights management
A.8.1.1 - Asset inventory and ownership
A.12.2.1 - Change management procedures
A.12.4.1 - Event logging and monitoring
A.13.1.1 - Network security perimeter
🔵 SAMA CSF
ID.AM-2 - Software platforms and applications are inventoried
PR.AC-1 - Identities and credentials are issued and managed
PR.AC-4 - Access rights are managed based on the principle of least privilege
DE.CM-1 - The network is monitored to detect potential cybersecurity events
DE.CM-3 - Personnel activity is monitored to detect anomalous behavior
RS.MI-2 - Incidents are mitigated
🟡 ISO 27001:2022
A.5.1 - Management direction for information security
A.6.1 - Screening
A.6.2 - User access management
A.8.1 - Asset inventory
A.12.2 - Change management
A.12.4 - Event logging
A.13.1 - Network security
🟣 PCI DSS v4.0.1
Requirement 1.1 - Firewall configuration standards
Requirement 2.1 - Default security parameters
Requirement 6.2 - Security patches and updates
Requirement 10.2 - User access logging
🔗 References & Sources 4
🔗
🔗
🔗
🔗
https://faruktuygun.com/directorytraversal.html
disclosure@vulncheck.com
https://www.exploit-db.com/exploits/48755
disclosure@vulncheck.com
https://www.ruijienetworks.com/
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/ruijie-networks-switch-eweb-srgos-directory-traversal
disclosure@vulncheck.com