Unauthenticated Arbitrary File Upload RCE in Ruijie NBR Routers

Successful exploitation allows a remote, unauthenticated attacker to achieve arbitrary code execution on the affected router in the security context of the web service. This can enable full compromise of the device's management plane exposed to that service, including execution of attacker-supplied commands or scripts, modification of device state, deployment of persistent web shells or other payloads, and potential use of the router as a foothold for further network access or disruption. The provided content also states that exploitation evidence was observed in the wild by the Shadowserver Foundation on 2025-01-14 UTC.

If a patch is not immediately available, restrict or disable access to the affected web management interface, especially from untrusted networks and the public Internet. Block requests to /ddi/server/fileupload.php where operationally feasible, place the management interface behind VPN or administrative network controls, and monitor for suspicious multipart POST requests and unexpected PHP or other executable files appearing in web-accessible directories. Additional mitigations include enforcing network ACLs around router administration, using reverse-proxy or WAF rules to block malicious upload attempts, and auditing devices for signs of uploaded web shells or unauthorized files.

Apply vendor-provided patches or firmware updates that correct the unsafe handling of uploads in /ddi/server/fileupload.php. The vulnerable upload logic should enforce strict server-side validation of allowed file types, reject executable content such as PHP scripts, sanitize and constrain filename and path-related parameters including name and uploadDir, and prevent writes to attacker-influenced or web-accessible directories. Uploaded files should be stored outside the web root and, where uploads are required, served only as inert content.