Command Injection Vulnerability in Ruijie RG-UAC

CVE-2024-4504

What is CVE-2024-4504?

The Ruijie RG-UAC product, which is part of network behavior management solutions, has been found to have a serious vulnerability in the /view/HAconfig/baseConfig/commit.php file. This issue allows attackers to manipulate the peer_ip or local_ip arguments, leading to OS command injection. Given the nature of this vulnerability, attackers can potentially execute arbitrary commands on the server remotely, exposing the network to various risks. It's crucial for users to be aware of this vulnerability due to its public disclosure and the lack of response from the vendor following the initial reports. Implementing necessary patches and monitoring systems for unusual activities is essential to mitigate potential exploits.

References