High · published December 12, 2025
⚡ An OS Command Injection in Ruijie RG-YST AP could turn your network device into a puppet on strings! 🎭 Think of it like a restaurant kitchen where a rogue diner whispers a secret recipe change to the chef — if the chef follows that order without questioning, the entire menu could be altered. That's how an attacker can issue arbitrary commands to your device through this vulnerability! The consequences are significant; an attacker could run any command they desire on your system, effectively taking control of it. This could lead to unauthorized access, data theft, or even using your device as a launching point for larger attacks. It’s a virtual doomsday for your network security!
Think of it like a restaurant kitchen where a rogue diner whispers a secret recipe change to the chef — if the chef follows that order without questioning, the entire menu could be altered. That's how an attacker can issue arbitrary commands to your device through this vulnerability! This vulnerability arises from the ability to send a crafted POST request to the 'pwdmodify' function in the /usr/lib/lua/luci/modules/common.lua file, allowing attackers to execute arbitrary commands without proper validation.
The consequences are significant; an attacker could run any command they desire on your system, effectively taking control of it. This could lead to unauthorized access, data theft, or even using your device as a launching point for larger attacks. It’s a virtual doomsday for your network security! To protect your network, promptly upgrade to the latest version of the Ruijie RG-YST AP firmware. Regularly audit your network devices for vulnerabilities and implement input validation to prevent command injection attacks. Stay vigilant! You've got this! By taking these steps, you'll be well on your way to securing your systems. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ruijie/rg-yst250f_firmware | all versions | — |
| ruijie/rg-est310_v2_firmware | all versions | — |
| ruijie/reyee_os | all versions | — |
| ruijie/reyee_os | all versions | — |
| ruijie/rg-eap602_firmware | all versions | — |