High · published December 12, 2025
🚨 A crafty POST request can let attackers unleash arbitrary commands on your network! 🔥 Think of it like a sneaky chef who gets unauthorized access to the kitchen and starts changing recipes at will — chaos ensues when they cook up something unexpected! 🍽️ This OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 is particularly concerning, as it allows attackers to execute any command they desire. Imagine an intruder manipulating your network settings, accessing sensitive data, or even shutting down critical services — it's a nightmare scenario! ⚡
Think of it like a sneaky chef who gets unauthorized access to the kitchen and starts changing recipes at will — chaos ensues when they cook up something unexpected! 🍽️ The flaw resides in the action_diagnosis function within the /usr/lib/lua/luci/controller/admin/diagnosis.lua file, allowing attackers to inject and run commands through crafted POST requests.
This OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 is particularly concerning, as it allows attackers to execute any command they desire. Imagine an intruder manipulating your network settings, accessing sensitive data, or even shutting down critical services — it's a nightmare scenario! ⚡ To safeguard against this vulnerability, it's crucial to patch the device as soon as possible and ensure you are running the latest firmware version. Additionally, consider implementing strict input validation to prevent any unauthorized command execution. 🛡️ You've got this! By taking these steps, you'll bolster your defenses and keep your network secure! 🔒
| Product | Versions | Fixed in |
|---|---|---|
| ruijie/rg-bcr860_firmware | all versions | — |