High · published December 12, 2025
⚡ A crafted POST request can let attackers execute arbitrary commands on Ruijie X60 PRO devices, making this vulnerability a hacker's playground! 🔥 Think of it like a restaurant where customers can not only place orders, but also sneak into the kitchen and cook whatever they want — complete culinary chaos! 🍽️ This OS Command Injection vulnerability could allow an attacker to compromise an entire network device, potentially leading to unauthorized access, data manipulation, or even full system takeover. With an 8.8 CVSS score, the consequences could be absolutely devastating if exploited!
Think of it like a restaurant where customers can not only place orders, but also sneak into the kitchen and cook whatever they want — complete culinary chaos! 🍽️ The flaw resides in the `module_set` function within the `/usr/local/lua/dev_sta/nbr_cwmp.lua` file, allowing attackers to inject and execute arbitrary shell commands via specially crafted inputs in POST requests.
This OS Command Injection vulnerability could allow an attacker to compromise an entire network device, potentially leading to unauthorized access, data manipulation, or even full system takeover. With an 8.8 CVSS score, the consequences could be absolutely devastating if exploited! Immediately update the Ruijie X60 PRO to the latest version that addresses this vulnerability. Additionally, implement strict input validation and monitor your network for suspicious activity. Don't wait! You've got this! By taking action now, you'll be a security hero in no time! 🦸♂️🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ruijie/rg-ew3200gx_firmware | all versions | — |
| ruijie/rg-x60_pro_firmware | all versions | — |