High · published December 12, 2025
⚡ A crafted POST request can send commands flying through your Ruijie RG-EW1200G PRO like a greased pig at a county fair! Think of it like a restaurant where the waiter can take any customer's order without checking the menu—this vulnerability lets an attacker serve up their own commands without a second thought, bypassing the safeguards entirely. This OS Command Injection vulnerability means a malicious user could execute arbitrary commands on your device, potentially leading to a total system compromise. Imagine an attacker gaining control over your router, opening the door to your entire network—absolutely devastating!
Think of it like a restaurant where the waiter can take any customer's order without checking the menu—this vulnerability lets an attacker serve up their own commands without a second thought, bypassing the safeguards entirely. The flaw exists in the module_set function of the file /usr/local/lua/dev_sta/nbr_cwmp.lua, allowing attackers to inject OS commands via specially crafted POST requests. This means they can gain unauthorized control over the device, executing any commands they desire.
This OS Command Injection vulnerability means a malicious user could execute arbitrary commands on your device, potentially leading to a total system compromise. Imagine an attacker gaining control over your router, opening the door to your entire network—absolutely devastating! To secure your device, update to the most recent firmware version immediately. Review your network configurations and consider implementing input validation to block such crafted requests. Be proactive to ensure your command execution pathways are secure! You've got this! Just follow these steps, and you'll harden your defenses like a pro! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ruijie/rg-ew1200g_pro_firmware | all versions | — |
| ruijie/rg-eap602_firmware | all versions | — |