High · published December 12, 2025
⚡ A crafty POST request can let attackers execute arbitrary commands on your Ruijie RG-EW1800GX PRO! 🚨 Think of it like a restaurant where someone hands the chef a fake order. If the chef doesn’t double-check, they might end up cooking something entirely wrong, which could ruin the whole dinner service! An attacker could gain total control over the device, running commands that could modify settings, exfiltrate data, or even disable the network. This is not just a minor inconvenience; it could cripple your entire network infrastructure if left unchecked!
Think of it like a restaurant where someone hands the chef a fake order. If the chef doesn’t double-check, they might end up cooking something entirely wrong, which could ruin the whole dinner service! This OS Command Injection vulnerability allows attackers to execute arbitrary commands via a crafted POST request targeting the module_set function in the config_retain.lua file.
An attacker could gain total control over the device, running commands that could modify settings, exfiltrate data, or even disable the network. This is not just a minor inconvenience; it could cripple your entire network infrastructure if left unchecked! To safeguard against this vulnerability, patch your device immediately to the latest firmware version available. Review your security configurations, and consider implementing strict input validation to mitigate similar risks in the future. You’ve got this! Secure your device, and you’ll keep your network running smoothly! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ruijie/rg-ew1800gx_pro_firmware | all versions | — |
| ruijie/rg-ew300n_firmware | all versions | — |