CVE-2019-16639

An issue was found on the Ruijie EG-2000 series gateway. There is a newcli.php API interface without access control, which can allow an attacker (who only has web interface access) to use TELNET commands and/or show admin passwords via the mode_url=exec&command= substring. This affects EG-2000SE EG_RGOS 11.9 B11P1.

• CWE-78

• https://0x.mk/?p=239Exploit, Third Party Advisory
• https://0x.mk/?p=239Exploit, Third Party Advisory

Published

Jul 16, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1659A vulnerability in the Identity Services Engine (ISE) integr…7.4
• CVE-2019-1660A vulnerability in the Simple Object Access Protocol (SOAP) …5.3
• CVE-2019-1661A vulnerability in the web-based management interface of Cis…6.1
• CVE-2019-1662A vulnerability in the Quality of Voice Reporting (QOVR) ser…8.2
• CVE-2019-1663A vulnerability in the web-based management interface of the…9.8
• CVE-2019-16638An issue was found on the Ruijie EG-2000 series gateway. An …7.5
• CVE-2019-1664A vulnerability in the hxterm service of Cisco HyperFlex Sof…7.8
• CVE-2019-16640An issue was found in upload.php on the Ruijie EG-2000 serie…7.5
• CVE-2019-16641An issue was found on the Ruijie EG-2000 series gateway. The…8.4
• CVE-2019-16642App\Mobile\Controller\ZhuantiController.class.php in TuziCMS…9.8
• CVE-2019-16643An issue was discovered in ZrLog 2.1.1. There is a Stored XS…5.4
• CVE-2019-16644App\Home\Controller\ZhuantiController.class.php in TuziCMS 2…9.8