A critical OS command injection vulnerability in the Ruijie X30-PRO router allows authenticated attackers to execute arbitrary commands, potentially leading to full system compromise.

The flaw exists due to improper input sanitization in the module_set function within the file /usr/local/lua/dev_sta/nbr_networkId_merge.lua, which permits authenticated users to inject and execute OS commands.

Successful exploitation allows an attacker to gain unauthorized control over the affected network device. Given the CVSS score of 8.8, this vulnerability poses a high risk to business operations, as it could lead to complete device takeover, lateral movement within the network, and potential data exfiltration.

Immediate Action: Contact the vendor immediately to obtain the latest firmware update for the X30-PRO, as no public patch is currently confirmed.

Proactive Monitoring: Inspect system logs for suspicious POST requests targeting the /usr/local/lua/dev_sta/nbr_networkId_merge.lua endpoint or unusual shell execution patterns.

Compensating Controls: Restrict administrative access to the device management interface to trusted IP addresses only and implement WAF rules to filter malicious payloads in POST requests.

Public Exploit Available: Yes — a public proof of concept is available via the researcher report hosted on GitHub.

Due to the severity of this command injection flaw and the availability of a public proof of concept, administrators should prioritize the restriction of management interfaces. Verify current firmware versions against the latest vendor releases and apply all security updates as soon as they become available to neutralize this high risk vector.