High · published December 11, 2025
⚡ A crafted POST request is all it takes to slip into Ruijie X30-PRO and unleash commands! 🚨 Think of it like handing a waiter a note with orders that aren't even on the menu. If they don’t double-check, they might serve up something no one wanted — crucial systems could be at risk! An attacker could potentially execute arbitrary commands on the device, which is absolutely devastating. This means they could modify settings, steal sensitive information, or disrupt the entire network — a serious disruption to operations.
Think of it like handing a waiter a note with orders that aren't even on the menu. If they don’t double-check, they might serve up something no one wanted — crucial systems could be at risk! This OS Command Injection vulnerability arises from insufficient input validation in the `nbr_networkId_merge.lua` script, allowing attackers to inject and execute arbitrary shell commands through specially crafted POST requests.
An attacker could potentially execute arbitrary commands on the device, which is absolutely devastating. This means they could modify settings, steal sensitive information, or disrupt the entire network — a serious disruption to operations. To mitigate this risk, urgently update the Ruijie X30-PRO firmware to the latest version, ensuring that all configurations follow best practices for input validation and security. Regularly audit your network for anomalies and unauthorized access. You've got this! With prompt action, you'll fortify your defenses in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ruijie/rg-yst250f_firmware | all versions | — |
| ruijie/rg-est310_v2_firmware | all versions | — |
| ruijie/reyee_os | all versions | — |
| ruijie/reyee_os | all versions | — |
| ruijie/rg-eap602_firmware | all versions | — |