An OS command injection vulnerability in the Ruijie RG-EW1300G router poses a critical risk by allowing authenticated attackers to execute arbitrary system commands.

The flaw exists within the /usr/local/lua/dev_sta/networkConnect.lua file, where insufficient input validation allows an authenticated user to inject malicious commands into the module_get parameter.

Successful exploitation allows an attacker to achieve full system compromise by executing arbitrary code with high privileges. This could lead to unauthorized network access, data exfiltration, or complete device takeover, which justifies the high CVSS score of 8.8. Such an incident poses a significant threat to internal network integrity and overall business continuity.

Immediate Action: Since a specific patch version is not currently identified, users should restrict administrative access to the device management interface to trusted personnel only and monitor for suspicious activity.

Proactive Monitoring: Review system logs for unusual POST requests directed at the networkConnect.lua endpoint and monitor for unexpected outbound traffic from the device.

Compensating Controls: Implement a Web Application Firewall (WAF) or network-level access control list (ACL) to block unauthorized attempts to reach the vulnerable Lua script endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as detailed in the GitHub repository cited in the vulnerability references.

Given the potential for remote code execution and the availability of public exploit documentation, this vulnerability should be treated with high priority. Organizations utilizing the affected Ruijie hardware must restrict management interface access and maintain a strict posture until the vendor releases a definitive firmware update to resolve the injection flaw.