High · published December 12, 2025
🔥 A rogue POST request is all it takes to unleash havoc! This OS Command Injection in Ruijie X30-PRO could let attackers run arbitrary commands on your system with ease. ⚡ Think of it like a restaurant where anyone can walk in and change the chef’s secret recipes just by writing a note — that’s how the vulnerability operates, letting attackers execute commands as if they were the chef! An attacker could take full control of the device, executing commands that might allow them to access sensitive information or manipulate system settings, leaving your network vulnerable to further exploitation. This could be absolutely devastating!
Think of it like a restaurant where anyone can walk in and change the chef’s secret recipes just by writing a note — that’s how the vulnerability operates, letting attackers execute commands as if they were the chef! This vulnerability in the Ruijie X30-PRO allows attackers to inject and execute commands through a crafted POST request targeting the setWisp function in the wireless.lua module.
An attacker could take full control of the device, executing commands that might allow them to access sensitive information or manipulate system settings, leaving your network vulnerable to further exploitation. This could be absolutely devastating! To protect your system, immediately patch the vulnerability by updating to the latest firmware version provided by Ruijie. Also, consider implementing stricter input validation on incoming requests to the setWisp endpoint. Don't wait! You've got this! Follow these steps, and you’ll safeguard your network in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ruijie/x30_pro_firmware | all versions | — |
| ruijie/rg-ew300_pro_firmware | all versions | — |
| ruijie/rg-eap602_firmware | all versions | — |