Unauthenticated Credential Disclosure in Ruijie NBR Routers /WEB_VMS/LEVEL15/

Successful exploitation allows an unauthenticated remote attacker to obtain administrative account credentials in plaintext. Disclosure of these credentials can lead to full compromise of the router's management plane, including unauthorized administrative access, configuration changes, interception or redirection of traffic, persistence through account or settings modification, and potential use of the device as a foothold for further network intrusion. Because the credentials are disclosed directly, the vulnerability materially reduces attacker effort and can enable immediate follow-on compromise.

Until patches can be applied, restrict access to the router management interface and specifically the vulnerable web endpoint to trusted administrative networks only. Remove direct internet exposure, place management services behind VPN or dedicated management network controls, enforce ACLs or firewall rules limiting access to HTTP/HTTPS administration, and disable remote management if not operationally required. Monitor for suspicious POST requests to /WEB_VMS/LEVEL15/, especially those with unusual Cookie headers or malformed parameters, and review logs and configurations for signs of unauthorized access. Rotate administrative credentials as a precaution.

Apply the vendor-provided security update or fixed firmware for affected Ruijie NBR series routers as soon as it is available. If a patched release already exists, upgrade all affected NBR2000G, NBR1300G, and NBR1000 devices and verify that the /WEB_VMS/LEVEL15/ endpoint no longer discloses credentials when accessed without authentication. Review administrative accounts on affected devices, rotate all router credentials that may have been exposed, and audit device configuration for unauthorized changes. If internet exposure existed, assume compromise and perform broader incident response validation.