An OS command injection vulnerability in Ruijie RG-BCR860 devices poses a critical risk of full system compromise for organizations utilizing this hardware.

The flaw exists in the action_service file located at /usr/lib/lua/luci/controller/admin/service.lua, where improper input validation allows an authenticated user to perform OS command injection. This vulnerability requires low privileges to execute, as indicated by the CVSS vector PR:L.

The ability to execute arbitrary commands on network infrastructure equipment can lead to a complete loss of confidentiality, integrity, and availability. With a CVSS score of 8.8, this vulnerability represents a high-severity risk that could allow an attacker to pivot into internal networks, intercept traffic, or disable security controls, resulting in significant operational disruption and potential data breaches.

Immediate Action: Contact Ruijie support or monitor the official vendor security portal to identify and apply the necessary firmware updates as soon as they become available.

Proactive Monitoring: Review device access logs for unusual POST requests directed at the action_service endpoint and monitor for unexpected outbound network connections originating from the device.

Compensating Controls: Implement strict network access control lists (ACLs) to limit management interface access to trusted administrative IP addresses only, effectively reducing the attack surface.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the research write-up referenced by the CVE record.

The severity of this command injection vulnerability necessitates immediate attention from network administrators. Organizations should prioritize restricting administrative access to the affected devices while awaiting official firmware patches from the vendor. Once a fix is released, it should be tested and deployed across the environment without delay to prevent unauthorized system access.