An OS command injection flaw in the Ruijie X30 PRO firmware poses a high risk of complete system compromise to affected network infrastructure.

The device suffers from an OS command injection vulnerability triggered by sending a malicious POST request to the module_get endpoint within the networkConnect.lua file. Per the CVSS vector (PR:L), this vulnerability requires the attacker to have low-level privileges on the device to successfully execute commands.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the underlying operating system. This could lead to a full device takeover, unauthorized access to sensitive network traffic, or the use of the device as a pivot point for further lateral movement within the corporate network. With a CVSS score of 8.8, this vulnerability represents a high-severity threat that necessitates immediate attention to prevent operational disruption and data exfiltration.

Immediate Action: Contact the vendor or check the official Ruijie support portal for firmware updates addressing this specific command injection vulnerability, as no public patch is currently confirmed.

Proactive Monitoring: Review system access logs for anomalous POST requests directed at the networkConnect module and monitor for unexpected outbound traffic from the device.

Compensating Controls: Restrict administrative access to the device management interface to trusted internal segments and deploy WAF rules to sanitize or block POST requests containing shell metacharacters.

Public Exploit Available: Unknown

Given the potential for complete system compromise, administrators should prioritize securing management interfaces and restricting access to authorized personnel only. Until a vendor-supplied patch is verified and applied, strict network segmentation and monitoring are essential to mitigate the risk of unauthorized command execution on the affected Ruijie hardware.