A critical OS command injection vulnerability in Ruijie RG-YST AP devices allows authenticated remote attackers to achieve full system compromise.

This is an OS command injection vulnerability located within the pwdmodify function of the /usr/lib/lua/luci/modules/common.lua file. The vulnerability is triggered by an authenticated attacker sending a malicious POST request to the affected endpoint.

The ability to execute arbitrary OS commands poses a severe risk to organizational infrastructure, as it grants attackers the potential for full control over the affected access point. A successful exploit could lead to complete system compromise, unauthorized lateral movement within the network, and potential data exfiltration. With a CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized access to internal network segments.

Immediate Action: Contact the vendor immediately to obtain the latest security firmware update for the RG-YST AP platform. If a patch is not yet available, restrict administrative access to the management interface to trusted internal IP addresses only.

Proactive Monitoring: Review system logs for suspicious HTTP POST requests directed toward the /usr/lib/lua/luci/modules/common.lua endpoint. Monitor for unexpected shell execution or unauthorized configuration changes on the affected devices.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to inspect and filter POST requests containing suspicious command injection patterns. Isolate the affected devices in a restricted VLAN to minimize the potential blast radius of a successful compromise.

Public Exploit Available: Yes, a published PoC exists, attributed to the security research write-up hosted on GitHub.

Given the potential for complete system takeover, administrators should treat this vulnerability with high priority. Apply the vendor-supplied security patch as soon as it is released, and ensure that management interfaces are not exposed to the public internet. Failure to mitigate this flaw increases the risk of persistent unauthorized access to your wireless infrastructure.