Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
CVE-2025-8763: Ruijie EG306MG VPN Configuration File Data Exposure
CVE-2025-8763 · published 1 year ago
Summary
A security issue in Ruijie EG306MG's VPN configuration file handling could allow attackers to access sensitive data without encryption. This could happen if an attacker remotely exploits this vulnerability. Immediate action is required to address this issue, as the vendor has not responded to the disclosure.
Original advisory text
A vulnerability was found in Ruijie EG306MG 3.0(1)B11P309. It has been rated as problematic. This issue affects some unknown processing of the file /etc/strongswan.conf of the component strongSwan....
A vulnerability was found in Ruijie EG306MG 3.0(1)B11P309. It has been rated as problematic. This issue affects some unknown processing of the file /etc/strongswan.conf of the component strongSwan. The manipulation of the argument i_dont_care_about_security_and_use_aggressive_mode_psk leads to missing encryption of sensitive data. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-310Cryptographic Issues
CWE-311Missing Encryption of Sensitive Data
Timeline
Published9 Aug 2025
Updated30 Oct 2026
First seen7 Mar 2026
Sources
CVE-2025-8763 · NVD
Track software like this
Free during beta