CVE-2024-5340

A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been rated as critical. Affected by this issue is some unknown functionality of the file /view/vpn/autovpn/sub_commit.php. The manipulation of the argument key leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-266246 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS v3 4.7 MEDIUM
CVSS v2.0 5.8 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

5.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:M/C:P/I:P/A:P

Exploitability : 6.4 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/z%7CYVDv%7CHKA)*%5CdK!/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-autovpn%3Asub_commit.php.pdf
https://vuldb.com/?ctiid.266246
https://vuldb.com/?id.266246
https://vuldb.com/?submit.336038
https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/z%7CYVDv%7CHKA)*%5CdK!/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-autovpn%3Asub_commit.php.pdf
https://vuldb.com/?ctiid.266246
https://vuldb.com/?id.266246
https://vuldb.com/?submit.336038

Configurations

No configuration.

History

21 Nov 2024, 09:47

Type	Values Removed	Values Added
References	() https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/z%7CYVDv%7CHKA)*%5CdK!/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-autovpn%3Asub_commit.php.pdf -	() https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/z%7CYVDv%7CHKA)*%5CdK!/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-autovpn%3Asub_commit.php.pdf -
References	~~() https://vuldb.com/?ctiid.266246 -~~	() https://vuldb.com/?ctiid.266246 -
References	~~() https://vuldb.com/?id.266246 -~~	() https://vuldb.com/?id.266246 -
References	~~() https://vuldb.com/?submit.336038 -~~	() https://vuldb.com/?submit.336038 -

28 May 2024, 12:39

Type	Values Removed	Values Added
Summary		(es) Se encontró una vulnerabilidad en Ruijie RG-UAC hasta 20240516 y se calificó como crítica. Una función desconocida del archivo /view/vpn/autovpn/sub_commit.php es afectada por esta vulnerabilidad. La manipulación de la clave del argumento conduce a la inyección de comandos del sistema operativo. El ataque puede lanzarse de forma remota. El exploit ha sido divulgado al público y puede utilizarse. VDB-266246 es el identificador asignado a esta vulnerabilidad. NOTA: Se contactó primeramente con el proveedor sobre esta divulgación, pero no respondió de ninguna manera.

25 May 2024, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-05-25 22:15

Updated : 2024-11-21 09:47

NVD link : CVE-2024-5340

Mitre link : CVE-2024-5340

CVE.ORG link : CVE-2024-5340

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

4.7 /10