CVE-2023-3450

This flaw lets someone who has login access reach a special “Network Diagnostic” screen and use it to make the device run attacker-chosen commands. Think of it like a maintenance panel on your equipment that’s supposed to only do safe checks—but in this case, it can be turned into a way to control the device itself. That can lead to disruption or unwanted changes to how the device operates.

This matters if you use or administer a Ruijie RG-BCR860 network device (including its firmware) and the device’s “Network Diagnostic Page” can be reached over the network by someone who has valid credentials. The vulnerability requires authentication, and it can be triggered remotely over the network. The risk is mainly when the diagnostic page is reachable from a network an attacker can access (for example, not properly restricted) and they can log in.

Treat this as urgent enough to act now on exposure control, because there is a public proof-of-concept and an attacker with network access and valid credentials can run arbitrary commands. There is no confirmed vendor patch information available yet, so reducing who can reach the diagnostic functionality is your immediate priority. This is rated AMBER for overall risk, meaning it’s not “ignore until later,” but it’s also not the highest “critical day-one” category.