CVE-2024-4815
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240506.
Does this matter?
Lower severity and a low EPSS score (6.41%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240506. Affected by this issue is some unknown functionality of the file /view/bugSolve/viewData/detail.php. The manipulation of the argument filename leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263936. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- CVSS 4.0
- 5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 6.41% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- ruijie/rg-uac 6000-cc firmware · ruijie/rg-uac 6000-e10 firmware · ruijie/rg-uac 6000-e10c firmware · ruijie/rg-uac 6000-e20 firmware · ruijie/rg-uac 6000-e20c firmware · ruijie/rg-uac 6000-e20m firmware · ruijie/rg-uac 6000-e50 firmware · ruijie/rg-uac 6000-e50c firmware · ruijie/rg-uac 6000-e50m firmware · ruijie/rg-uac 6000-ea firmware · ruijie/rg-uac 6000-ei firmware · ruijie/rg-uac 6000-isg02 firmware · ruijie/rg-uac 6000-isg10 firmware · ruijie/rg-uac 6000-isg200 firmware · ruijie/rg-uac 6000-isg40 firmware · ruijie/rg-uac 6000-si firmware · ruijie/rg-uac 6000-u3100 firmware · ruijie/rg-uac 6000-u3210 firmware · ruijie/rg-uac 6000-x100 firmware · ruijie/rg-uac 6000-x100s firmware · +7 more
- Source
- cna@vuldb.com
References
- https://github.com/h0e4a0r1t/I_L-HxK-pF-uZ1-/blob/main/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-view_bugSolve_viewData_detail.php.pdfBroken Link
- https://vuldb.com/?ctiid.263936Permissions Required, VDB Entry
- https://vuldb.com/?id.263936Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.329966Third Party Advisory, VDB Entry
- https://github.com/h0e4a0r1t/I_L-HxK-pF-uZ1-/blob/main/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-view_bugSolve_viewData_detail.php.pdfBroken Link
- https://vuldb.com/?ctiid.263936Permissions Required, VDB Entry
- https://vuldb.com/?id.263936Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.329966Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.