High · published December 11, 2025
⚡ A crafted POST request can trigger a command execution nightmare! The OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO could allow attackers to execute arbitrary commands on your device. 🔥 Picture this: a delivery driver takes your package but instead of checking the address, they just drive anywhere, opening the door to any home! That’s what’s happening here; the system blindly accepts external commands without verifying them. If exploited, an attacker could take control of your device, running any command they desire. This means they could manipulate settings, extract sensitive data, or even bring the system to its knees – absolutely devastating!
Picture this: a delivery driver takes your package but instead of checking the address, they just drive anywhere, opening the door to any home! That’s what’s happening here; the system blindly accepts external commands without verifying them. The OS Command Injection vulnerability allows attackers to execute arbitrary commands through a maliciously crafted POST request targeting the module_set in the file /usr/local/lua/dev_sta/nbr_cwmp.lua. This flaw gives them a backdoor into your system.
If exploited, an attacker could take control of your device, running any command they desire. This means they could manipulate settings, extract sensitive data, or even bring the system to its knees – absolutely devastating! To safeguard your system, immediately patch to the latest version that resolves this vulnerability, and ensure that proper input validation is implemented. Regularly audit your system to identify and rectify any insecure configurations. You've got this! Stay vigilant, follow these steps, and keep your environment secure! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ruijie/rg-yst250f_firmware | all versions | — |
| ruijie/rg-est310_v2_firmware | all versions | — |
| ruijie/reyee_os | all versions | — |
| ruijie/reyee_os | all versions | — |
| ruijie/rg-eap602_firmware | all versions | — |