A directory traversal vulnerability in Ruijie Networks switches allows unauthenticated attackers to exfiltrate sensitive configuration files, including plaintext credentials, posing a severe security risk.

The application is susceptible to a path traversal flaw in the /download.do endpoint. By injecting directory traversal sequences into the file parameter, an unauthenticated attacker can bypass access controls to read arbitrary files from the underlying filesystem.

The ability for an unauthenticated attacker to retrieve configuration files directly leads to the exposure of administrative credentials, network topology information, and system settings. This unauthorized access compromises the confidentiality of the network infrastructure, potentially facilitating lateral movement or full device takeover. With a CVSS score of 7.5, this high-severity vulnerability represents a significant threat to internal network integrity.

Immediate Action: Update the affected Ruijie switch firmware to the latest version provided by the vendor that addresses this directory traversal flaw.

Proactive Monitoring: Review device access logs for suspicious GET requests targeting the /download.do endpoint, specifically looking for sequences containing ../ or other path traversal patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize requests containing directory traversal sequences (such as ../) directed at the web management interface.

Public Exploit Available: Yes, a functional exploit is available via the Exploit-DB entry 48755.

Given the availability of public exploit code and the high potential for credential theft, organizations using Ruijie S29_RGOS switches must prioritize patching. If an immediate update is not feasible, ensure that the management interface is not exposed to the public internet and restrict access to authorized management segments only.