High · published December 12, 2025
⚡ An unassuming POST request can unleash chaos! This OS command injection flaw in Ruijie X60 PRO lets attackers execute any command they want — like a night shift worker suddenly having the keys to the entire operation. 🔥 Think of it like a restaurant where the chef can take any order without checking with the manager. This vulnerability allows an attacker to send a crafted request that the system trusts blindly, letting them cook up anything they want behind the scenes. If exploited, an attacker could manipulate the device to execute arbitrary commands, leading to unauthorized access, data breaches, or even a complete takeover of the system. This could have devastating effects, leaving your network vulnerable and exposed to malicious activities.
Think of it like a restaurant where the chef can take any order without checking with the manager. This vulnerability allows an attacker to send a crafted request that the system trusts blindly, letting them cook up anything they want behind the scenes. The vulnerability is found in the networkConnect.lua file, where a POST request to the module_get function can be manipulated to run arbitrary OS commands on the server, bypassing normal security checks.
If exploited, an attacker could manipulate the device to execute arbitrary commands, leading to unauthorized access, data breaches, or even a complete takeover of the system. This could have devastating effects, leaving your network vulnerable and exposed to malicious activities. Immediately patch affected devices to version V1.01 or V2.01. Review your network configurations and consider implementing strict input validation to prevent similar issues. Regularly audit your systems for vulnerabilities to stay ahead! You've got this! Follow these steps, and you’ll be securing your systems like a pro in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ruijie/rg-x60_pro_firmware | all versions | — |
| ruijie/rg-ew1200_firmware | all versions | — |