CVE-2024-4813: Ruijie RG-UAC interface_commit.php os command injection
A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240506. Affected is an unknown function of the file /view/networkConfig/physicalInterface/interfacecommit.php. The manipulation of the argument name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-263934 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ruijie RG-UACto a version that resolves this vulnerability.Patch VDB-263934
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4813?
CVE-2024-4813 is classified as critical due to its potential for OS command injection.
How do I fix CVE-2024-4813?
To remediate CVE-2024-4813, upgrade your Ruijie RG-UAC firmware to the latest version beyond 20240506.
What systems are affected by CVE-2024-4813?
CVE-2024-4813 affects Ruijie RG-UAC firmware versions up to and including 20240506.
What type of vulnerability is CVE-2024-4813?
CVE-2024-4813 is an OS command injection vulnerability, allowing attackers to execute arbitrary commands.
Can I exploit CVE-2024-4813 remotely?
Yes, CVE-2024-4813 can potentially be exploited remotely if the vulnerable interface is accessible.