High · published December 12, 2025
⚡ A crafted POST request can unleash a storm! This OS Command Injection vulnerability in Ruijie RG-YST EST allows attackers to execute arbitrary commands with ease! 🔥 Think of it like a sneaky contractor who, after being granted access to your home, decides to change the locks without your permission — they could gain full control! This vulnerability lets attackers issue commands that could modify system behavior or access sensitive data. If exploited, attackers could execute any command on the affected system, potentially leading to unauthorized access, data breaches, or even disabling critical services. This could be absolutely devastating for your network's integrity!
Think of it like a sneaky contractor who, after being granted access to your home, decides to change the locks without your permission — they could gain full control! This vulnerability lets attackers issue commands that could modify system behavior or access sensitive data. This vulnerability occurs because the pwdmodify function in the common.lua file doesn't properly sanitize user inputs, allowing an attacker to inject and execute arbitrary OS commands via a specially crafted POST request.
If exploited, attackers could execute any command on the affected system, potentially leading to unauthorized access, data breaches, or even disabling critical services. This could be absolutely devastating for your network's integrity! Immediate action is essential! Update your Ruijie RG-YST EST devices to the latest available version that addresses this vulnerability. Additionally, review and sanitize input handling in your Lua scripts to prevent similar issues. You've got this! Follow these steps, and you'll keep your systems safe and sound! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ruijie/rg-yst250f_firmware | all versions | — |
| ruijie/rg-est310_v2_firmware | all versions | — |
| ruijie/reyee_os | all versions | — |
| ruijie/reyee_os | all versions | — |
| ruijie/rg-eap602_firmware | all versions | — |