Attack Chain

1. Initial Access: An unauthenticated remote attacker identifies a vulnerable Ruijie RG-UAC device exposed on the internet.
2. Exploitation: The attacker crafts and sends a specially malformed HTTP POST request to the user_auth_commit.php endpoint on the vulnerable Ruijie RG-UAC device.
3. Unrestricted Upload: Within the POST request, the attacker manipulates the upload_image argument to include a malicious file, such as a webshell (e.g., shell.php or cmd.jsp), which the vulnerable application then writes to a web-accessible directory on the server due to the flaw.
4. Malicious File Placement: The RG-UAC application fails to properly validate the uploaded file's type, content, or extension, allowing the attacker's chosen payload to be stored on the system.
5. Remote Code Execution Trigger: The attacker sends a subsequent HTTP GET request to the known or inferred path of the uploaded webshell, causing the server to execute the malicious code embedded within it.
6. Post-Exploitation: With the webshell executed, the attacker gains remote command execution capabilities on the underlying operating system of the Ruijie RG-UAC device, enabling further actions like data exfiltration, system modification, or pivot to other internal network resources.

Impact

Successful exploitation of CVE-2026-14736 grants an unauthenticated remote attacker arbitrary file upload capabilities, which can directly lead to remote code execution (RCE) on the compromised Ruijie RG-UAC device. This enables full control over the affected system, allowing attackers to manipulate configurations, exfiltrate sensitive data, disrupt network operations, or establish a foothold for lateral movement within the victim's network. While no specific victim organizations or sectors have been detailed in the public information, any organization utilizing vulnerable versions of Ruijie RG-UAC devices is at risk due to the remote nature of the exploit and its public availability.

Recommendation

• Immediately patch CVE-2026-14736 by updating all Ruijie RG-UAC devices to a version beyond 1.0-R1.8.2.p5 as recommended by the vendor.
• Ensure proper web server logging is enabled for all internet-facing devices, specifically logging HTTP POST and GET requests including URI stems, query parameters, and user-agent strings.
• Review web server logs for suspicious POST requests to /user_auth_commit.php followed by anomalous GET requests to newly created files in web-accessible directories, which could indicate exploitation attempts related to CVE-2026-14736.