CVE-2024-2909

A vulnerability classified as critical was found in Ruijie RG-EG350 up to 20240318. Affected by this vulnerability is the function setAction of the file /itbox_pi/networksafe.php?a=set of the component HTTP POST Request Handler. The manipulation of the argument bandwidth leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257977 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-78

• https://h0e4a0r1t.github.io/2024/vulns/Ruijie%20EG350%20Easy%20Gateway%20Management%20System%20Exists%20Remote%20Code%20Execution%20Vulnerability%20networksafe.php.pdfBroken Link
• https://vuldb.com/?ctiid.257977Permissions Required, VDB Entry
• https://vuldb.com/?id.257977Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.300368Third Party Advisory, VDB Entry
• https://h0e4a0r1t.github.io/2024/vulns/Ruijie%20EG350%20Easy%20Gateway%20Management%20System%20Exists%20Remote%20Code%20Execution%20Vulnerability%20networksafe.php.pdfBroken Link
• https://vuldb.com/?ctiid.257977Permissions Required, VDB Entry
• https://vuldb.com/?id.257977Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.300368Third Party Advisory, VDB Entry

Published

Mar 26, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-29080Potential vulnerabilities have been identified in the HP Dis…6.5
• CVE-2024-29082Improper access control vulnerability affecting Vonets ind…8.6
• CVE-2024-29083Incorrect default permissions in some Intel(R) Distribution …6.7
• CVE-2024-29085Improper access control for some BigDL software maintained b…5.5
• CVE-2024-29086in OpenHarmony v3.2.4 and prior versions allow a local attac…5.5
• CVE-2024-29089Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2024-29090Server-Side Request Forgery (SSRF) vulnerability in Jordy Me…6.8
• CVE-2024-29091Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2024-29092Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2024-29093Cross-Site Request Forgery (CSRF) vulnerability in Saleswond…4.3
• CVE-2024-29094Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2024-29095Improper Neutralization of Input During Web Page Generation …5.9