PT-2024-37441 · Ruijie · Ruijie Rg-Uac

Wind-Liberty · Published 2024-06-20 · Updated 2025-08-21 · CVE-2024-6187

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Ruijie RG-UAC version 1.0

Description: A critical vulnerability has been found in the file /view/vpn/autovpn/sub commit.php, where the manipulation of the key argument leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations: For Ruijie RG-UAC version 1.0, as a temporary workaround, consider restricting access to the /view/vpn/autovpn/sub commit.php file until a patch is available. Avoid using the key argument in this file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-6187

Affected Products

Ruijie Rg-Uac

References · 10

• 🔥 https://github.com/L1OudFd8cl09/CVE/blob/main/11_06_2024_d.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-6187 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6187 · Vendor Advisory
• https://twitter.com/linuxpatch/status/1803791714261361047 · Twitter Post
• https://vuldb.com/?id.269158 · Note
• https://vuldb.com/?ctiid.269158 · Note
• https://twitter.com/CVEnew/status/1803784928464658486 · Twitter Post
• https://t.me/cveNotify/132976 · Telegram Post
• https://vuldb.com/?submit.354125 · Note
• https://t.me/cvenotify/83912 · Telegram Post