High · published December 12, 2025
🚨 A crafted POST request is all it takes to execute arbitrary commands on your Ruijie RG-BCR600W! ⚡ This vulnerability lives in the get_wanobj function and could lead to serious consequences if left unchecked. Think of it as a restaurant where customers can order anything off the menu, but one sneaky diner figures out they can ask for items not listed — opening the door for chaos in the kitchen! 🍽️ An attacker could leverage this vulnerability to run any command they desire on your device, which could lead to unauthorized access, data leaks, or even complete control over your network. This could be absolutely devastating for your infrastructure and data security!
Think of it as a restaurant where customers can order anything off the menu, but one sneaky diner figures out they can ask for items not listed — opening the door for chaos in the kitchen! 🍽️ This OS Command Injection flaw allows attackers to inject and execute arbitrary commands via a crafted POST request. The vulnerable code resides in the /usr/lib/lua/luci/controller/admin/common.lua file, specifically in the get_wanobj function.
An attacker could leverage this vulnerability to run any command they desire on your device, which could lead to unauthorized access, data leaks, or even complete control over your network. This could be absolutely devastating for your infrastructure and data security! To remediate this issue, patch your Ruijie RG-BCR600W firmware to the latest version as soon as it becomes available. Additionally, consider implementing strict input validation to filter out potentially malicious requests. Don't wait — take action now! You've got this! With a quick patch and some added security measures, you can lock down your system in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ruijie/rg-bcr600w_firmware | all versions | — |