CVE-2024-2909 - Ruijie RG-EG350 HTTP POST Request setAction os command injection

Back Back to CVE browser

HIGH

Ruijie RG-EG350 HTTP POST Request setAction os command injection

Published Mar 26, 2024

8.8

HIGH

CVSS 3.1

EPSS 3.99%

Description

A vulnerability classified as critical was found in Ruijie RG-EG350 up to 20240318. Affected by this vulnerability is the function setAction of the file /itbox_pi/networksafe.php?a=set of the component HTTP POST Request Handler. The manipulation of the argument bandwidth leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257977 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Ruijie Product RG-EG350 Default
n/a
- Version
  20240318
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Ruijie

RG-EG350

n/a

Version	Status	Constraints
20240318	affected	-

Vendor Ruijie Product RG-Eg350 Default
n/a
- Version
  20240318
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Ruijie

RG-Eg350

n/a

Version	Status	Constraints
20240318	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-27853
Advisory
https://h0e4a0r1t.github.io/2024/vulns/Ruijie%20EG350%20Easy%20Gateway%20Management%20System%20Exists%20Remote%20Code%20Execution%20Vulnerability%20networksafe.php.pdf
exploitBroken Link
https://vuldb.com/?ctiid.257977
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.257977
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.300368
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-27853		Advisory
https://h0e4a0r1t.github.io/2024/vulns/Ruijie%20EG350%20Easy%20Gateway%20Management%20System%20Exists%20Remote%20Code%20Execution%20Vulnerability%20networksafe.php.pdf		exploitBroken Link
https://vuldb.com/?ctiid.257977		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.257977		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.300368		third-party-advisoryThird Party AdvisoryVDB Entry