CVE-2024-5340

A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been rated as critical. Affected by this issue is some unknown functionality of the file /view/vpn/autovpn/sub_commit.php. The manipulation of the argument key leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-266246 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-78

• https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/z%7CYVDv%7CHKA)*%5CdK!/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-autovpn%3Asub_commit.php.pdfBroken Link
• https://vuldb.com/?ctiid.266246Permissions Required, VDB Entry
• https://vuldb.com/?id.266246Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.336038Third Party Advisory, VDB Entry
• https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/z%7CYVDv%7CHKA)*%5CdK!/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-autovpn%3Asub_commit.php.pdfBroken Link
• https://vuldb.com/?ctiid.266246Permissions Required, VDB Entry
• https://vuldb.com/?id.266246Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.336038Third Party Advisory, VDB Entry

Published

May 25, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-53382Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (wi…5.4
• CVE-2024-53384A DOM Clobbering vulnerability in tsup v8.3.4 allows attacke…5.1
• CVE-2024-53386Stage.js through 0.8.10 allows DOM Clobbering (with resultan…6.1
• CVE-2024-53387A DOM Clobbering vulnerability in umeditor v1.2.3 allows att…8.8
• CVE-2024-53388A DOM Clobbering vulnerability in mavo v0.3.2 allows attacke…8.8
• CVE-2024-5339A vulnerability was found in Ruijie RG-UAC up to 20240516. I…7.2
• CVE-2024-53406Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissio…8.8
• CVE-2024-53407In Phiewer 4.1.0, a dylib injection leads to Command Executi…3.3
• CVE-2024-53408AVE System Web Client v2.1.131.13992 was discovered to conta…5.4
• CVE-2024-5341The The Plus Addons for Elementor Page Builder plugin for Wo…5.4
• CVE-2024-53412Command injection in the connect function in NietThijmen Sho…8.4
• CVE-2024-5342The Simple Image Popup Shortcode plugin for WordPress is vul…5.4