CVE-2021-43164 in RG-EW
Summary
by MITRE • 05/04/2022
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the updateVersion function in /cgi-bin/luci/api/wireless.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/06/2026
The CVE-2021-43164 vulnerability represents a critical remote code execution flaw affecting Ruijie Networks RG-EW Series routers running ReyeeOS version 1.55.1915 or earlier. This vulnerability specifically targets the updateVersion function within the web interface API endpoint located at /cgi-bin/luci/api/wireless, creating an avenue for attackers to execute arbitrary commands on affected devices. The issue stems from inadequate input validation and sanitization within the wireless configuration management interface, allowing malicious actors to inject and execute unauthorized code remotely without requiring authentication credentials.
The technical exploitation of this vulnerability occurs through manipulation of parameters passed to the updateVersion function, which processes wireless network configuration updates. Attackers can craft specially crafted HTTP requests that bypass normal authentication mechanisms and directly invoke the vulnerable function, enabling them to execute system commands with the privileges of the web server process. This flaw falls under the CWE-77 vulnerability category, specifically representing a command injection weakness where user-supplied data is directly incorporated into system command execution without proper sanitization. The vulnerability exists at the application layer within the router's web management interface, making it accessible over the network and exploitable by remote attackers who can reach the device's web interface.
The operational impact of this vulnerability is severe and far-reaching for organizations relying on affected Ruijie routers. Successful exploitation allows attackers to gain complete control over the affected devices, enabling them to modify network configurations, establish persistent backdoors, exfiltrate sensitive data, and potentially use the compromised routers as launch points for lateral movement within networks. The vulnerability affects the core wireless functionality of the routers, potentially disrupting network services while simultaneously providing attackers with unauthorized access to the underlying operating system. This represents a significant risk to network security posture, as routers serve as critical network infrastructure components that, when compromised, can provide attackers with privileged network access and control over network traffic flows.
Mitigation strategies for CVE-2021-43164 should prioritize immediate patching of affected devices with the latest firmware versions released by Ruijie Networks. Organizations should implement network segmentation to limit access to router management interfaces and enforce strict firewall rules to restrict access to the vulnerable API endpoints. Additional protective measures include disabling unnecessary wireless features, implementing robust network monitoring to detect anomalous traffic patterns, and conducting comprehensive network assessments to identify other potentially vulnerable devices. Security teams should also consider implementing intrusion detection systems specifically configured to detect exploitation attempts targeting the vulnerable API endpoint. The vulnerability aligns with ATT&CK technique T1059.001 for command and scripting interpreter and T1071.004 for application layer protocol, making it particularly dangerous in enterprise environments where such attacks can lead to complete network compromise and data breaches.