CVE-2024-4255 is a Medium (CVSS 4.7) OS command injection in Ruijie RG-UAC internet behavior management devices, through gre_edit_commit.php and its name argument. The description itself calls it critical. The record names no fixed version, so ask Ruijie and keep the web console off untrusted networks.
What's affected
- Product: Ruijie RG-UAC, with the RG-UAC 6000 CC and 6000 E10 models listed in the CPE entries. The description says "up to 20240419", which reads as a build date.
- Affected file: /view/networkConfig/GRE/gre_edit_commit.php, argument name. The record writes the path with a space, so I quote it loosely here.
- Fixed version: none on record. Contact the vendor.
- Severity conflict: NVD's CVSS score is 4.7, Medium, and the vector requires high privileges (PR:H). The description text says the issue "was classified as critical", a VulDB label. A fair reading is that the score is moderate because of the privilege requirement, while the weakness class is serious.
- Exploitation: the record says an exploit was disclosed publicly. KEV is false.
How to check if you're exposed
Check the build date of each RG-UAC on the system information page and compare it with 20240419. Any build at or before that date matches the description.
Then check reachability of the management interface. It should be limited to an administration network or VPN. List the accounts with administrator rights, since the vector requires high privileges.
What to do now
- Inventory RG-UAC units and their build dates.
- Restrict the web console to a management network and block access from user networks and the internet.
- Audit administrator accounts, remove stale ones, and enforce unique passwords.
- Ask Ruijie support whether a build after 20240419 fixes this CVE and get the answer in writing.
- Monitor the device for unexpected configuration changes, especially GRE tunnel settings.
Why it matters
The record maps the issue to CWE-78, OS command injection. A parameter called name reaches an operating system command without being neutralized, so a crafted value can change what the command does.
A medium score does not make this harmless. Command injection on a gateway appliance that inspects user traffic is a serious foothold. The privilege requirement is the main brake, so guard administrator access carefully.
Quick check
Why is the score only 4.7 when the text says critical?
NVD's vector requires high privileges, which lowers the number. The critical label comes from the VulDB description text. Report both if you brief others.
Is there a fixed build?
The record names none. Ask Ruijie before assuming a later build fixes it.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4255 (published 2024-04-27) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
