IoT Cloud Cracked by 'Open Sesame' Over-the-Air Attack

Claroty Team82 disclosed ten critical vulnerabilities in Ruijie Networks' Reyee cloud platform, including multiple CVEs with CVSS scores of 9.0 and higher, that permit weak-authentication abuse, cloud impersonation, and remote code execution on cloud-connected access points. Researchers demonstrated the "Open Sesame" scenario—using a device serial number obtained from Wi‑Fi beacons plus MQTT weaknesses—to deliver a malicious OS command and obtain a reverse shell; Claroty estimates tens of thousands of potentially affected devices worldwide, and Ruijie has released patches.