An OS command injection vulnerability in Ruijie M18 EW_3 routers allows authenticated attackers to achieve remote code execution, posing a severe risk to network integrity.

This vulnerability is an OS command injection flaw located in the /usr/local/lua/dev_sta/networkConnect.lua file. It permits an authenticated attacker to inject and execute arbitrary system commands by sending a maliciously crafted POST request to the module_get endpoint.

The ability to execute arbitrary commands on network infrastructure allows an attacker to gain full control over the device, potentially leading to unauthorized network access, data interception, or the use of the router as a pivot point for further attacks. With a CVSS score of 8.8, this vulnerability is classified as High severity, reflecting the significant potential for system compromise and operational disruption.

Immediate Action: Administrators should restrict management interface access to trusted networks and monitor for vendor-provided firmware updates that address this specific vulnerability.

Proactive Monitoring: Security teams should monitor system logs for suspicious POST requests directed at the networkConnect.lua file and look for unexpected process execution patterns on the router.

Compensating Controls: Implement strict network access control lists to limit the exposure of the administrative interface to only authorized IP addresses, effectively reducing the attack surface.

Public Exploit Available: Yes, a public proof of concept exists, as documented in the technical report referenced on GitHub by the vulnerability researcher.

Given the high CVSS score and the ease of command execution once authenticated, this vulnerability represents a significant risk to organizational security. Administrators are urged to prioritize the hardening of device management interfaces and to apply vendor patches immediately upon release to prevent unauthorized code execution.