A critical OS command injection vulnerability exists in the Ruijie M18 EW_3 device, which could allow an authenticated attacker to gain full control over the affected hardware.

This is an OS command injection flaw located within the module_set function of the file /usr/local/lua/dev_sta/nbr_cwmp.lua. The vulnerability requires the attacker to have low-level privileges to submit a crafted POST request that triggers arbitrary command execution.

The ability to execute arbitrary OS commands poses a severe risk to network security, as it allows for complete system compromise, potential data exfiltration, and the ability to use the device as a pivot point for further lateral movement within the network. With a CVSS score of 8.8, this vulnerability is classified as High severity and necessitates immediate attention to prevent unauthorized administrative access and potential service disruption.

Immediate Action: Since no official patch is currently identified, restrict access to the device management interface to trusted internal segments only and monitor for suspicious POST requests targeting the identified Lua script.

Proactive Monitoring: Review device access logs for unauthorized attempts to access /usr/local/lua/dev_sta/nbr_cwmp.lua and monitor for unexpected outbound traffic or anomalous process execution on the router.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block POST requests containing shell metacharacters or suspicious payloads directed at the vulnerable module_set endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research report hosted on GitHub.

Given the potential for full system compromise, administrators should treat this vulnerability with extreme urgency. Even in the absence of an official vendor patch, immediate network segmentation and strict access control for the management interface are required to minimize the attack surface. Organizations should continue to monitor vendor communication channels for the release of a firmware update that addresses the identified command injection flaw.