An OS command injection vulnerability in Ruijie RG-EW1200G PRO firmware poses a severe risk of full system compromise for affected routers.

The flaw exists in the file /usr/local/lua/dev_config/config_retain.lua, where improper sanitization of input allows an authenticated attacker to inject and execute arbitrary OS commands via the module_set parameter. The CVSS vector (PR:L) indicates that the attacker must possess valid user credentials to trigger this vulnerability.

Successful exploitation allows for complete control over the network device, which can be leveraged to intercept traffic, pivot into internal network segments, or facilitate further attacks. With a CVSS score of 8.8, this high-severity vulnerability represents a significant threat to organizational data confidentiality, integrity, and operational availability.

Immediate Action: Restrict administrative access to the device management interface to trusted internal segments only and monitor for vendor-provided firmware updates that address this command injection flaw.

Proactive Monitoring: Review device access logs for unusual POST requests directed at /usr/local/lua/dev_config/config_retain.lua or unexpected system calls originating from the web management service.

Compensating Controls: Implement strict firewall rules to ensure the device management interface is not exposed to the public internet, thereby reducing the attack surface for unauthorized or compromised accounts.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research repository hosted on GitHub.

Given the high CVSS score and the existence of a public proof-of-concept, users of the Ruijie RG-EW1200G PRO should treat this vulnerability with high urgency. Administrators must isolate the device management interface and prepare to apply security patches as soon as the vendor releases them to prevent potential lateral movement within the network.