High · published December 12, 2025
⚡ An OS Command Injection vulnerability in Ruijie X60 PRO lets attackers execute arbitrary commands with just a crafty POST request! This could spell trouble if you're not paying attention. 🔥 Think of it like a sneaky delivery person who shows up with a package and has full access to your building because no one checks their ID — they could drop off anything, including malicious commands! If exploited, this vulnerability could allow attackers to take full control of your device, execute unwanted commands, and potentially cause significant disruptions to your network. Imagine a rogue digital intruder wreaking havoc — they could change configurations, access sensitive data, or even disable critical services. This is absolutely devastating!
Think of it like a sneaky delivery person who shows up with a package and has full access to your building because no one checks their ID — they could drop off anything, including malicious commands! This OS Command Injection vulnerability exists in the Ruijie X60 PRO's config_retain.lua file, allowing attackers to execute arbitrary commands through a specially crafted POST request to the module_set endpoint without any authentication checks.
If exploited, this vulnerability could allow attackers to take full control of your device, execute unwanted commands, and potentially cause significant disruptions to your network. Imagine a rogue digital intruder wreaking havoc — they could change configurations, access sensitive data, or even disable critical services. This is absolutely devastating! To protect yourself, immediately patch to the latest firmware version provided by Ruijie. Ensure that you have strict input validation in place for POST requests and monitor your network for any suspicious activity. This is key to keeping your system secure! You’ve got this! With these steps, you’ll be well on your way to securing your systems against this vulnerability. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ruijie/rg-x60_pro_firmware | all versions | — |
| ruijie/rg-ew1200_firmware | all versions | — |