High · published December 11, 2025
⚡ An OS Command Injection vulnerability in Ruijie RG-RAP2200(E) could allow attackers to execute arbitrary commands with just a crafted POST request! 📡 Think of this as a restaurant where a customer sneaks in a special order that the chef never sees—resulting in anything from a strange dish to a full-on kitchen disaster. 🍽️ If the cooks don’t check the orders carefully, chaos ensues! An attacker could execute any command on the device, potentially gaining control over it! This means they could modify settings, intercept data, or even disable the device entirely, leading to serious disruptions.
Think of this as a restaurant where a customer sneaks in a special order that the chef never sees—resulting in anything from a strange dish to a full-on kitchen disaster. 🍽️ If the cooks don’t check the orders carefully, chaos ensues! The vulnerability exists in the file /usr/local/lua/dev_sta/nbr_cwmp.lua, allowing unauthorized commands to be executed through a malformed POST request to the module_set endpoint.
An attacker could execute any command on the device, potentially gaining control over it! This means they could modify settings, intercept data, or even disable the device entirely, leading to serious disruptions. Immediate action is crucial! Update Ruijie RG-RAP2200(E) to the latest firmware that addresses this vulnerability. Additionally, review network configurations to limit exposure and consider implementing strict input validation. You’ve got this! 🛡️ Stay proactive, patch that firmware, and keep your network secure!
| Product | Versions | Fixed in |
|---|---|---|
| ruijienetworks/reyee_os | all versions | — |
| ruijienetworks/reyee_os | all versions | — |
| ruijie/rg-rap2200\(e\)_firmware | all versions | — |