CVE-2023-7304CWE-78

Ruijie RG-UAC nmc_sync.php Command Injection

Critical · published October 15, 2025

CVSS v4.0
9.3
EPSS
4%
Percentile
89.3
In the wild
Unconfirmed
What it is

Ruijie RG-UAC Application Management Gateway contains a command injection vulnerability via the 'nmc_sync.php' interface. An unauthenticated attacker able to reach the affected endpoint can inject shell commands via crafted request data, causing the application to execute arbitrary commands on the host. Successful exploitation can yield full control of the application process and may lead to system-level access depending on the service privileges. VulnCheck has observed this vulnerability being targeted by the RondoDox botnet campaign.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.03556 · 89.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-10-15T01:22Z
EPSS history
Timeline
  • 15 OCT 01:22Z
    Ruijie RG-UAC nmc_sync.php Command Injection
    cvelistv5