CVE-2024-5339

A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view/vpn/autovpn/online_check.php. The manipulation of the argument peernode leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266245 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-78

• https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/z%7CYVDv%7CHKA)*%5CdK!/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-autovpn%3Aonline_check.php.pdfBroken Link
• https://vuldb.com/?ctiid.266245Permissions Required, VDB Entry
• https://vuldb.com/?id.266245Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.336037Third Party Advisory, VDB Entry
• https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/z%7CYVDv%7CHKA)*%5CdK!/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-autovpn%3Aonline_check.php.pdfBroken Link
• https://vuldb.com/?ctiid.266245Permissions Required, VDB Entry
• https://vuldb.com/?id.266245Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.336037Third Party Advisory, VDB Entry

Published

May 25, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-5338A vulnerability was found in Ruijie RG-UAC up to 20240516. I…7.2
• CVE-2024-53382Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (wi…5.4
• CVE-2024-53384A DOM Clobbering vulnerability in tsup v8.3.4 allows attacke…5.1
• CVE-2024-53386Stage.js through 0.8.10 allows DOM Clobbering (with resultan…6.1
• CVE-2024-53387A DOM Clobbering vulnerability in umeditor v1.2.3 allows att…8.8
• CVE-2024-53388A DOM Clobbering vulnerability in mavo v0.3.2 allows attacke…8.8
• CVE-2024-5340A vulnerability was found in Ruijie RG-UAC up to 20240516. I…7.2
• CVE-2024-53406Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissio…8.8
• CVE-2024-53407In Phiewer 4.1.0, a dylib injection leads to Command Executi…3.3
• CVE-2024-53408AVE System Web Client v2.1.131.13992 was discovered to conta…5.4
• CVE-2024-5341The The Plus Addons for Elementor Page Builder plugin for Wo…5.4
• CVE-2024-53412Command injection in the connect function in NietThijmen Sho…8.4