OS Command Injection Vulnerability in Ruijie RG-UAC Products

CVE-2024-4255

What is CVE-2024-4255?

An OS command injection vulnerability has been identified in the Ruijie RG-UAC Unified Internet Behavior Management Audit System. The flaw resides in the file handling process of gre_edit_commit.php, allowing an attacker to manipulate input arguments and execute arbitrary commands on the host system. This vulnerability is exploitable remotely, posing significant risks to affected installations. Organizations using the RG-UAC products should apply security patches and implement monitoring for any unusual activity related to this exploit, as it has already been publicly disclosed, increasing the urgency for remediation.

References