A critical OS command injection vulnerability in the Ruijie RG-EW1800GX PRO router allows authenticated attackers to achieve full system compromise.

The flaw exists in the module_set function within the config_retain file, where improper input sanitization allows for OS command injection. The CVSS vector PR:L indicates that an attacker must possess low-level privileges to successfully trigger this vulnerability via a crafted POST request.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the underlying operating system. This could lead to a complete loss of confidentiality, integrity, and availability of the router, potentially exposing the internal network to further lateral movement. With a CVSS score of 8.8, this represents a high-severity risk that could facilitate unauthorized access to sensitive administrative functions or internal traffic.

Immediate Action: Contact Ruijie support or monitor the official vendor security portal for firmware releases that address this command injection flaw.

Proactive Monitoring: Review device access logs for unusual POST requests directed at the module_set endpoint or suspicious system calls originating from the web management interface.

Compensating Controls: Restrict administrative access to the device management interface by implementing firewall rules that limit access to trusted internal IP addresses only.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up published on GitHub.

Given the potential for full system compromise, administrators should treat this vulnerability with high urgency. If a firmware update is not immediately available, restrict access to the device management interface to authorized personnel only to mitigate the risk of exploitation by malicious actors.