A critical OS command injection vulnerability in the Ruijie X30-PRO router enables authenticated attackers to achieve full system compromise.

This is an OS command injection flaw located in the setWisp function within the wireless module. Successful exploitation requires a low-privileged authenticated user to send a specially crafted POST request, which then executes arbitrary commands with system level privileges.

The ability to execute arbitrary commands on network infrastructure poses a severe threat to organizational security. An attacker could leverage this vulnerability to gain full control over the router, intercept sensitive network traffic, pivot into internal segments, or render the device inoperable, causing significant operational downtime. With a CVSS score of 8.8, this flaw represents a high-risk entry point for lateral movement within the network.

Immediate Action: Contact Ruijie support or check the official vendor portal for firmware updates addressing this command injection vulnerability. If no patch is currently available, restrict management access to the device to trusted administrative IP addresses only.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the wireless configuration modules. Alert on any unexpected shell process execution or anomalous outbound traffic originating from the router management interface.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System to inspect and block malicious POST requests containing shell metacharacters directed at the setWisp endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists (referenced in the GitHub repository provided by the vulnerability reporter).

Given the high CVSS score and the public availability of technical details regarding the injection vector, this vulnerability should be prioritized for remediation. IT administrators must ensure that administrative access to the Ruijie X30-PRO is strictly controlled and that firmware is updated as soon as a vendor-supplied security patch is released.