An OS command injection vulnerability in the Ruijie RG-EW1200 router allows an authenticated attacker to achieve full remote code execution on the affected device.

The vulnerability exists due to improper neutralization of special elements used in an OS command within the module_get function, specifically in the file /usr/local/lua/dev_sta/networkConnect.lua. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates that an attacker must possess low-level privileges to perform the attack, which is triggered via a crafted POST request.

The ability to execute arbitrary OS commands presents a critical risk, as it allows an attacker to gain complete control over the network device. This can lead to total system compromise, unauthorized access to internal network traffic, and potential lateral movement into the broader corporate environment. With a CVSS score of 8.8, this vulnerability is classified as High severity due to the high impact on confidentiality, integrity, and availability.

Immediate Action: Contact Ruijie support or check the official vendor portal for firmware updates addressing this command injection flaw, as no public patch is currently confirmed.

Proactive Monitoring: Monitor device access logs for suspicious POST requests targeting the /usr/local/lua/dev_sta/networkConnect.lua endpoint.

Compensating Controls: Restrict administrative access to the management interface to trusted IP addresses only and ensure that the device is not exposed directly to the public internet.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research repository provided by the vulnerability reporter.

Given the potential for complete system compromise and the existence of a public proof-of-concept, users of the Ruijie RG-EW1200 should prioritize securing their devices immediately. Administrators are urged to restrict access to the device management interface and maintain close contact with the vendor for official firmware updates to remediate this injection flaw.