OS Command Injection in Ruijie RG-UAC Products

CVE-2024-5336

What is CVE-2024-5336?

A significant security vulnerability has been identified in the Ruijie RG-UAC product, specifically in the function addVlan located in the file /view/networkConfig/vlan/vlan_add_commit.php. This flaw allows an attacker to manipulate the argument phyport, resulting in an OS command injection. The risk is heightened due to the remote nature of the exploit, making it accessible to malicious actors without physical access to the network. As of now, the vendor has not provided any response regarding this critical issue, which has been publicly disclosed. Organizations using the affected versions are urged to review their security posture and implement necessary mitigations to protect against potential exploits.

References