What’s Vulnerable › Vulnerabilities

CVE-2023-7304: Ruijie RG-UAC nmc_sync.php Command Injection

• Severity: critical (CVSS 9.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-15 · updated 2026-06-17
• Weakness: CWE-78

Description

Ruijie RG-UAC Application Management Gateway contains a command injection vulnerability via the 'nmc_sync.php' interface. An unauthenticated attacker able to reach the affected endpoint can inject shell commands via crafted request data, causing the application to execute arbitrary commands on the host. Successful exploitation can yield full control of the application process and may lead to system-level access depending on the service privileges. VulnCheck has observed this vulnerability being targeted by the RondoDox botnet campaign.

Affected products

• Ruijie Networks Co., Ltd. RG-UAC: all versions

References

• https://cn-sec.com/archives/2284248.html
• https://www.vulncheck.com/advisories/ruijie-rg-uac-nmc-sync-php-command-injection

Get alerted when CVE-2023-7304 or the next vulnerability affects your stack