CVE-2024-6185: Ruijie RG-UAC commit.php get_ip_addr_details os command injection
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC 1.0. Affected by this issue is the function getipaddrdetails of the file /view/dhcp/dhcpConfig/commit.php. The manipulation of the argument ethname leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269156. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6185?
CVE-2024-6185 is classified as a critical vulnerability.
How does CVE-2024-6185 exploit the system?
CVE-2024-6185 allows for OS command injection via the manipulation of the ethname argument in the get_ip_addr_details function.
Which software versions are affected by CVE-2024-6185?
CVE-2024-6185 affects Ruijie RG-UAC firmware version 1.0.
What is the potential impact of CVE-2024-6185?
The exploitation of CVE-2024-6185 may lead to unauthorized command execution on the affected system.
How can I fix CVE-2024-6185?
To fix CVE-2024-6185, it is recommended to update the Ruijie RG-UAC firmware to a version that is not impacted by this vulnerability.