CVE-2024-6185: Ruijie RG-UAC Firmware RCE Vulnerability

CVE-2024-6185 Overview

CVE-2024-6185 is an OS command injection vulnerability in Ruijie RG-UAC 1.0 unified access control appliances. The flaw resides in the get_ip_addr_details function within /view/dhcp/dhcpConfig/commit.php. Attackers manipulate the ethname argument to inject arbitrary operating system commands. The vulnerability is remotely exploitable and requires low-level authentication. Public exploit details have been disclosed through VulDB entry VDB-269156. Ruijie was contacted early about this disclosure but did not respond, leaving the flaw unpatched. The vulnerability is tracked under [CWE-78] (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact
Authenticated remote attackers can execute arbitrary operating system commands on Ruijie RG-UAC devices through the DHCP configuration interface, compromising network access control infrastructure.

Affected Products

Ruijie RG-UAC 1.0 (hardware appliance)
Ruijie RG-UAC Firmware 1.0
Unified Access Control appliances running the vulnerable commit.php handler

Discovery Timeline

2024-06-20 - CVE-2024-6185 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6185

Vulnerability Analysis

The vulnerability exists in the DHCP configuration commit handler of the Ruijie RG-UAC web management interface. The get_ip_addr_details function in /view/dhcp/dhcpConfig/commit.php accepts an ethname parameter from HTTP requests. This parameter is passed to an operating system shell without proper sanitization or validation. Attackers who supply shell metacharacters within ethname cause the appliance to execute injected commands under the privileges of the web service. Because the RG-UAC is a network access control device, successful exploitation grants a foothold on infrastructure that governs internal network access policies. The EPSS score of 9.094% (94.8th percentile) indicates elevated exploitation likelihood relative to typical CVEs. See the public disclosure on GitHub for reported reproduction details.

Root Cause

The root cause is direct concatenation of user-controlled input into a shell command string within get_ip_addr_details. The application invokes a system command that references the ethname value to enumerate interface details. No allowlist, escaping, or safe API is applied before the shell invocation. This pattern is classified under [CWE-78] and is common in embedded web management interfaces that wrap Linux networking utilities.

Attack Vector

Exploitation occurs over the network against the appliance's web management interface. The attacker submits a crafted HTTP request to commit.php with a malicious ethname value containing shell metacharacters such as backticks, semicolons, or the $() construct. The injected payload runs with the privileges of the underlying PHP/web process. Public documentation and VulDB submission 354121 describe the parameter and endpoint required for the attack.

No verified proof-of-concept code has been published. See the VulDB entry and the referenced GitHub write-up for reported technical details.

Detection Methods for CVE-2024-6185

Indicators of Compromise

HTTP POST or GET requests to /view/dhcp/dhcpConfig/commit.php containing shell metacharacters (;, |, &, backticks, $() in the ethname parameter.
Unexpected child processes spawned by the RG-UAC web server, such as sh, bash, wget, curl, or nc.
Outbound connections from the appliance to unfamiliar external IP addresses shortly after DHCP configuration requests.
New or modified files under web-writable directories on the appliance file system.

Detection Strategies

Inspect web access logs on the RG-UAC and any upstream reverse proxy for requests to commit.php with suspicious ethname values.
Deploy network intrusion detection signatures that flag command injection patterns in HTTP parameters targeting Ruijie management endpoints.
Correlate authentication events against the management interface with subsequent configuration commits to identify anomalous administrative activity.

Monitoring Recommendations

Forward RG-UAC web and system logs to a central SIEM for continuous review.
Alert on outbound traffic originating from management VLANs where the appliance resides, as these devices should not initiate arbitrary internet connections.
Baseline normal commit.php request patterns and alert on deviations in parameter length, character set, or request frequency.

How to Mitigate CVE-2024-6185

Immediate Actions Required

Restrict access to the RG-UAC management interface to a dedicated administrative network or jump host using firewall rules or ACLs.
Disable remote or internet-exposed access to /view/dhcp/dhcpConfig/commit.php and the broader web console.
Rotate all administrative credentials on affected appliances and audit account activity for signs of misuse.
Inventory Ruijie RG-UAC 1.0 devices in the environment and prioritize network segmentation around them.

Patch Information

No vendor patch is available. According to the NVD entry, Ruijie was contacted early about this disclosure but did not respond. Organizations should monitor the Ruijie support portal for future firmware updates and consider replacement or decommissioning of unsupported appliances.

Workarounds

Place the RG-UAC management interface behind a VPN or bastion host requiring multi-factor authentication.
Apply strict source-IP allowlists at upstream firewalls so only trusted administrator workstations can reach the management interface.
Deploy a web application firewall in front of the appliance to block requests containing shell metacharacters in the ethname parameter.
If the DHCP configuration feature is not required, disable the associated administrative role for non-essential accounts.

bash

# Example upstream firewall restriction (iptables) limiting access to the RG-UAC management interface
iptables -A FORWARD -s 10.10.0.0/24 -d <RG-UAC-IP> -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d <RG-UAC-IP> -p tcp --dport 443 -j DROP