Hillstone Networks

'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>

RULE（RULE ID：346048）

Rule General Information


Release Date:		2026-09-09

Rule Name:		Ruijie RG-UAC online_check.php Command Injection Vulnerability (CVE-2024-5339)

Severity:

CVE ID:

Rule Protection Details


Description:		A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view/vpn/autovpn/online_check.php. The manipulation of the argument peernode leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266245 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Impact:		An attacker can execute arbitrary command via a successful exploit in the context of the vulnerable software.

Affected OS:		Windows, Linux, Others

Reference:		https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/z%7CYVDv%7CHKA)*%5CdK!/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-autovpn%3Aonline_check.php.pdf https://vuldb.com/?ctiid.266245 https://vuldb.com/?id.266245 https://vuldb.com/?submit.336037

Solutions

No vendor advisory or fixed firmware build is publicly documented for CVE-2024-5339. Check Ruijie's official RG-UAC software page for a fixed build; until then, restrict management-plane reachability of /view/vpn/autovpn/online_check.php and deploy a network IPS signature that flags shell metacharacters in the peernode parameter. Server-side remediation is to validate peernode as an IP address or hostname and escape it before shell execution. See https://www.ruijie.com.cn/fw/wd-gj-uac/