An OS command injection vulnerability in the Ruijie X30-PRO allows authenticated attackers to achieve full system compromise through malicious input to the host_access_delay module.

This vulnerability is an OS command injection flaw located in the /usr/local/lua/dev_sta/host_access_delay.lua file. It requires the attacker to have low-level privileges to send a crafted POST request to the module_get endpoint, resulting in arbitrary command execution on the underlying operating system.

The ability to execute arbitrary commands on network infrastructure presents a severe risk to organizational security. Successful exploitation grants an attacker full control over the affected router, potentially leading to unauthorized network access, data interception, and the redirection of traffic. With a CVSS score of 8.8, this high-severity flaw represents a critical threat to internal network integrity and availability.

Immediate Action: Contact the vendor immediately to obtain the appropriate firmware update for the X30-PRO-V1_09241521 version, as no public patch is currently confirmed.

Proactive Monitoring: Review system and access logs for suspicious POST requests directed at the host_access_delay module or irregular administrative activity.

Compensating Controls: Restrict management access to the device to trusted IP addresses only and ensure that the administrative interface is not exposed to the public internet.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the researcher's report on GitHub.

Given the severity of this command injection vulnerability, organizations using the Ruijie X30-PRO should treat this as a high priority. Until a formal vendor patch is verified and applied, administrators must restrict access to the device management interface to minimize the attack surface. Monitor for any unauthorized configuration changes or unexpected device behavior that could indicate exploitation.