CVE-2024-6187

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. This vulnerability affects unknown code of the file /view/vpn/autovpn/sub_commit.php. The manipulation of the argument key leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-269158 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Ruijie	RG-UAC	1.0
ruijie	rg-uac	1.0

References

https://github.com/L1OudFd8cl09/CVE/blob/main/11_06_2024_d.mdExploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.269158Permissions Required, VDB Entry
https://vuldb.com/?id.269158Third Party Advisory, VDB Entry
https://vuldb.com/?submit.354125Third Party Advisory, VDB Entry
https://github.com/L1OudFd8cl09/CVE/blob/main/11_06_2024_d.mdExploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.269158Permissions Required, VDB Entry
https://vuldb.com/?id.269158Third Party Advisory, VDB Entry
https://vuldb.com/?submit.354125Third Party Advisory, VDB Entry

Timeline

Published: Jun 20, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-61885.3A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic. This issue affects some unknown processing of CVE-2024-61898.8A vulnerability was found in Tenda A301 15.13.08.12. It has been classified as critical. Affected is the function fromSetWirelessRepeat of t CVE-2024-61909.8A vulnerability was found in itsourcecode Farm Management System 1.0. It has been rated as critical. Affected by this issue is some unknown CVE-2024-61919.8A vulnerability classified as critical has been found in itsourcecode Student Management System 1.0. This affects an unknown part of the fil CVE-2024-61929.8A vulnerability classified as critical was found in itsourcecode Loan Management System 1.0. This vulnerability affects unknown code of the CVE-2024-61939.8A vulnerability, which was classified as critical, has been found in itsourcecode Vehicle Management System 1.0. This issue affects some unk CVE-2024-61949.8A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. Affected is an unknown functio CVE-2024-61959.8A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this vulnerability is CVE-2024-61969.8A vulnerability was found in itsourcecode Banking Management System 1.0 and classified as critical. Affected by this issue is some unknown f CVE-2024-61977.5libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error CVE-2024-61987.7The device exposes a web interface on ports TCP/3030 and TCP/9882. This web service runs lighttpd, which implements the “SNORE” interface. T CVE-2024-61997.7An unauthenticated attacker on the WAN interface, with the ability to intercept Dynamic DNS (DDNS) traffic between DDNS services and the mod