CVE-2026-14736: Ruijie RG-UAC Unrestricted File Upload Vulnerability—Remote Exploitation Without Authentication

Technical summary

The vulnerability exists in user_auth_commit.php where insufficient input validation on the upload_image parameter permits unrestricted file uploads. The affected administrative function fails to enforce proper access controls (CWE-284) and lacks adequate file upload restrictions (CWE-434). The attack vector is network-based with low complexity and requires no authentication or user interaction, making it trivially exploitable by remote threat actors.

Business impact

Successful exploitation enables attackers to upload malicious files (webshells, backdoors, or malware) directly onto RG-UAC appliances. This grants initial access for lateral movement into protected networks, persistent backdoor establishment, and potential compromise of network access control policy enforcement. Organizations relying on RG-UAC for network segmentation face degraded security posture if the vulnerability is exploited before patching.

Affected systems

Ruijie RG-UAC versions up to and including 1.0-R1.8.2.p5 are vulnerable. Determine your current version via the RG-UAC administrative interface and compare against the affected range. Verify whether your instance is internet-facing or isolated to internal networks, as this affects exposure timeline.

Exploitability

Exploitability is high. The attack requires no authentication, no user interaction, and no complex techniques—making it accessible to opportunistic attackers. Public exploits are confirmed available, meaning adversaries have weaponized tools ready. The CVSS 3.1 score of 7.3 (HIGH) reflects network accessibility and the ability to achieve confidentiality, integrity, and availability impacts simultaneously. Expect active reconnaissance and exploitation attempts within days of public disclosure.

Remediation

Immediately verify your RG-UAC version and confirm whether a patched release is available from Ruijie. Contact Ruijie support or consult their security advisory for the specific patch version addressing this vulnerability. Until a patch is available and deployable, implement network-level controls to restrict direct access to the RG-UAC management interface to trusted administrative networks only.

Patch guidance

Verify the latest patched version from Ruijie's official security advisory. Apply patches during a maintenance window after validating compatibility with your deployment. If a patch is not yet available, prioritize limiting network exposure of the RG-UAC appliance by implementing firewall rules to block untrusted inbound access to the administration interface. Document the patch application date and version applied for compliance records.

Detection guidance

Monitor RG-UAC logs for POST requests to user_auth_commit.php with upload_image parameters containing unexpected file types or paths. Network-level detection should flag HTTP/HTTPS traffic to the RG-UAC management port from external or unexpected sources. Inspect uploaded files in the RG-UAC web directory for recently created executables or scripts. Review authentication logs for any successful logins correlating with suspicious upload activity.

Why prioritize this

This vulnerability merits immediate attention due to the convergence of high CVSS severity (7.3), zero authentication requirement, public exploit availability, and the critical security function of the affected product. RG-UAC is a network access control appliance; compromise enables attackers to circumvent the security controls protecting your infrastructure. The low attack complexity and lack of prerequisites make this a likely candidate for widespread exploitation in coming weeks.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects a network-accessible vulnerability with no authentication or user interaction barriers, coupled with multi-faceted impact: attackers can read sensitive data (confidentiality), alter system behavior through malicious uploads (integrity), and disrupt RG-UAC operations (availability). The availability of public exploits elevates real-world risk beyond the base CVSS score.

Frequently asked questions