An unrestricted file upload vulnerability in Ruijie RG-UAC permits unauthenticated remote attackers to execute arbitrary code by uploading malicious files to the system.

The vulnerability resides in the user_auth_commit.php file, which fails to properly validate file types during the upload process. This allows an unauthenticated remote attacker to bypass security controls and upload malicious files via the upload_image argument.

The CVSS score of 7.3 (High) reflects the critical nature of unrestricted file upload vulnerabilities, which often lead to Remote Code Execution (RCE). Successful exploitation could allow an attacker to gain full control over the affected appliance, resulting in complete system compromise and potential lateral movement within the network.

Immediate Action: Apply the latest vendor security updates provided by Ruijie. If updates are unavailable, disable the affected file upload functionality if not strictly required for business operations.

Proactive Monitoring: Monitor the filesystem for unexpected executable files or scripts in directories where images or user-submitted content are stored.

Compensating Controls: Utilize a WAF to restrict file upload types and enforce strict access controls on the user_auth_commit.php endpoint.

Public Exploit Available: True

This vulnerability represents a severe risk due to the potential for arbitrary code execution. Organizations using Ruijie RG-UAC must prioritize applying the latest firmware or security patches to mitigate the risk of unauthorized system access.