RCE in Ruijie Networks Co., Ltd. Rg-Uac

CVE-2023-7304

Ruijie RG-UAC Application Management Gateway contains a command injection vulnerability via the 'nmc_sync.php' interface. An unauthenticated attacker able to reach the affected endpoint can inject shell commands via crafted request data, causing the application to execute arbitrary commands on the host. Successful exploitation can yield full control of the application process and may lead to system-level access depending on the service privileges. VulnCheck has observed this vulnerability being targeted by the RondoDox botnet campaign.

Vulnerability class: Command Injection (OS Command Injection)

Published · last modified .

EPSS exploit prediction

EPSS: 0.036 (88.9th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 88.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2023-7304: held from 0.036 to 0.036.

EPSS over last 30 days · oldest: 0.036 · newest: 0.036 · change: -0.001

Affected products

Weakness classification (CWE)

References