Title: CRITICAL SECURITY & PRIVACY VULNERABILITY: Lack of PPPoE Intra-Client Isolation on RG-EG1510XS (ReyeeOS) [Print this page] Author: Rizky Aidil Time: 2026-10-22 07:54 Title: CRITICAL SECURITY & PRIVACY VULNERABILITY: Lack of PPPoE Intra-Client Isolation on RG-EG1510XS (ReyeeOS) Dear Ruijie Engineering & Product Development Team,
I am writing to formally report a critical architectural security defect in the ReyeeOS firmware running on the RG-EG1510XS gateway.
Currently, the platform lacks L3 ACLs on Virtual-Templates and does not support intra-PPPoE client isolation. As a result, PPPoE subscribers within the same pool can freely scan, access, and attempt to log into other subscribers' ONT/ONU web interfaces.
Legal & Regulatory Compliance Implication:
Under personal data protection laws and telecommunications privacy regulations, allowing unauthorized cross-client access to subscriber premises equipment (CPE) constitutes a severe data privacy breach and security hazard. As an ISP operator, using hardware with unmitigated peer-to-peer exposure puts us at immediate risk of regulatory non-compliance and legal liability.
Required Urgent Action:
A gateway designed for PPPoE deployment must enforce client isolation at the Virtual-Template level. We strongly urge your software development team to treat this as an urgent Security Vulnerability and release a firmware update implementing:
Intra-PPPoE pool traffic isolation (blocking peer-to-peer communication between PPPoE clients).
Virtual-Template ACL capability to drop unauthorized cross-subnet/gateway access.
We expect this critical flaw to be escalated immediately to your core development team for a permanent patch.
Sincerely,
DIL-NET.ID Network Engineering Team
Welcome to Ruijie Community (https://community.ruijie.com/)