OS Command Injection Vulnerability in Ruijie RG-UAC
CVE-2024-5337
What is CVE-2024-5337?
A critical vulnerability has been identified in Ruijie RG-UAC devices prior to version 20240516, which involves an OS command injection due to improper handling of user input in the 'user_commit.php' file. Specifically, the manipulation of the 'email2' or 'user_name' parameters can allow attackers to execute arbitrary commands on the affected systems. This vulnerability poses a significant threat, as it may be exploited remotely, providing unauthorized access to sensitive system functionalities. Security researchers disclosed this vulnerability publicly, highlighting the urgent need for affected users to apply patches or mitigate the risks associated with this threat. Unfortunately, attempts to contact Ruijie Networks regarding this issue received no response.
Affected Version(s)
RG-UAC 20240516