High · published December 11, 2025
⚡ One crafty POST request is all it takes to run arbitrary commands on the Ruijie RG-EW1300G! 🚨 Think of it like a restaurant kitchen that takes orders without verifying what's on the ticket. If a mischievous patron slips in a note asking for something outrageous, the chefs could unwittingly whip it up! This OS command injection vulnerability could allow attackers to execute any command they desire on your device. Imagine the chaos: unauthorized access to sensitive data, system alterations, or even full control over the network device – a recipe for disaster!
Think of it like a restaurant kitchen that takes orders without verifying what's on the ticket. If a mischievous patron slips in a note asking for something outrageous, the chefs could unwittingly whip it up! This vulnerability exists in Ruijie's networkConnect.lua file, allowing attackers to inject malicious commands via a specially crafted POST request sent to the module_get endpoint, bypassing usual security checks.
This OS command injection vulnerability could allow attackers to execute any command they desire on your device. Imagine the chaos: unauthorized access to sensitive data, system alterations, or even full control over the network device – a recipe for disaster! Update the firmware to the latest version to patch this vulnerability. Regularly review your network security settings and limit access to essential services only. Consider implementing additional security measures like intrusion detection systems. You’ve got this! With these steps, you’ll be on your way to securing your network in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ruijie/rg-ew1300g_firmware | all versions | — |
| ruijie/be50_firmware | all versions | — |