An OS command injection vulnerability in the Ruijie RG-EW1800GX PRO allows authenticated attackers to achieve full system compromise through crafted network requests.

This is an OS command injection flaw located in the nbr_cwmp.lua file. It allows an attacker with low-level privileges to inject and execute arbitrary system commands by sending a malicious POST request to the module_set function.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands with the privileges of the underlying service. This poses a severe risk to business operations, as it could lead to full device takeover, lateral movement within the network, or the exfiltration of sensitive configuration data. With a CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized access.

Immediate Action: Contact Ruijie support or monitor official security channels for a firmware update that addresses the command injection in the nbr_cwmp.lua module.

Proactive Monitoring: Review system and web access logs for suspicious POST requests directed at the module_set endpoint, specifically looking for shell metacharacters or unexpected command strings.

Compensating Controls: Implement strict network access controls to limit the number of users who can reach the management interface, and utilize a Web Application Firewall to block requests containing anomalous payloads.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research repository provided by the vulnerability reporter.

Given the High severity of this command injection vulnerability, organizations using the affected Ruijie hardware must prioritize the identification and isolation of these devices. Until an official vendor patch is released and verified, administrators should restrict network access to the device management interface to trusted administrative subnets only. Prompt application of the security update is essential once available to mitigate the risk of unauthorized system-level code execution.