High · published December 12, 2025
⚡ A sneaky OS command injection lurks in Ruijie X30-PRO! A crafted POST request can execute arbitrary commands, like a mischievous chef swapping ingredients in your recipe without telling you. 🍽️ Imagine you're at a restaurant, and the chef starts throwing in secret ingredients without your approval! That's like this vulnerability, where an attacker can dash in commands through an unsuspecting POST request, changing the outcome of your system's 'menu' without permission. With this vulnerability, an attacker could execute arbitrary commands on the system, leading to devastating consequences like data loss, system compromise, or even a full takeover. It’s like giving a stranger the keys to your kitchen and letting them cook whatever chaos they desire!
Imagine you're at a restaurant, and the chef starts throwing in secret ingredients without your approval! That's like this vulnerability, where an attacker can dash in commands through an unsuspecting POST request, changing the outcome of your system's 'menu' without permission. This OS command injection vulnerability affects Ruijie X30-PRO, allowing attackers to run any command they choose by exploiting the `pwdmodify` function in the common.lua module through a crafted POST request.
With this vulnerability, an attacker could execute arbitrary commands on the system, leading to devastating consequences like data loss, system compromise, or even a full takeover. It’s like giving a stranger the keys to your kitchen and letting them cook whatever chaos they desire! To mitigate this risk, patch your Ruijie X30-PRO to the latest version immediately. Make sure to validate and sanitize all incoming data and consider implementing additional layers of security to monitor outgoing commands. You've got this! Follow these steps, and you’ll be well on your way to securing your system! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ruijie/x30_pro_firmware | all versions | — |
| ruijie/rg-eap602_firmware | all versions | — |
| ruijie/rg-est350_firmware | all versions | — |
| ruijie/rg-ew300_pro_firmware | all versions | — |
| ruijie/rg-est310_firmware | all versions | — |