CVE-2024-4813 is a medium severity OS command injection flaw in the Ruijie RG-UAC unified internet behavior management appliance, scored 6.3. It affects builds up to 20240506 and the vendor did not respond to the disclosure. Restrict the management interface and ask Ruijie for a fixed build.
What's affected
The record lists the RG-UAC family, including firmware and models such as the RG-UAC 6000 CC and E10, up to 20240506. The flaw is in the file /view/networkConfig/physicalInterface/interface_commit.php, and the name argument reaches an operating system command. The weakness is CWE-78. The record says the attack can start remotely and the exploit is public. It says the vendor was contacted early and did not respond.
The record also says it is recommended to apply a patch, but names no patch and no fixed version. I could not confirm one, so contact Ruijie for a current build.
NVD scores it 6.3 Medium with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, while VulDB's wording calls it critical. The KEV flag is false.
Three sibling records, CVE-2024-4814, CVE-2024-4815 and CVE-2024-4816, describe the same weakness class in other files of the same appliance. This post covers the physical interface commit page only, but the advice applies to all four.
How to check if you're exposed
- Identify every RG-UAC device from your asset inventory and network scans.
- Check the firmware build date on each and compare it with 20240506.
- Test whether the management web interface answers from the internet or from user networks.
- Check device logs for configuration commits you did not make.
What to do now
- Remove the management interface from the internet and from user networks.
- Allow access only from a small set of admin workstations.
- Use unique, strong admin passwords, since the vector needs a login.
- Ask Ruijie for a patched build and read any advisory it publishes.
- Back up the configuration and compare it to a known good copy.
- If the device stays unpatched, plan to replace it.
Why it matters
A gateway that monitors and filters traffic sits in a position of trust. A command injection on it runs with the rights of the appliance, and the settings pages that take network names and addresses are the sort of place where input is passed to the shell.
The class is CWE-78: the application builds a system command from request values without cleaning them. A silent vendor lengthens the exposure, which makes network level controls the main defence until a fix arrives.
Quick check
Do the sibling CVEs need separate action?
They name other files, so ask the vendor about all of them, but restricting the management interface helps with every one.
Sources
- Public write up referenced by the record (not read)
- VulDB entry 263934 (not readable without a browser session)
- NVD record data for CVE-2024-4813
Last reviewed: 19 October 2026.
