A critical OS command injection vulnerability in Ruijie RG-EW1800GX routers allows authenticated attackers to achieve remote code execution, posing a significant risk to network integrity.

This vulnerability is an OS command injection flaw located within the networkConnect.lua script. Attackers with low-level privileges can trigger this issue by sending a crafted POST request to the module_get endpoint, leading to full system command execution.

The ability to execute arbitrary commands on network infrastructure represents a critical security failure, as it allows for complete system compromise. With a CVSS score of 8.8, this vulnerability could facilitate lateral movement, unauthorized data access, or the redirection of network traffic, leading to significant operational disruption and loss of trust.

Immediate Action: Contact the vendor or monitor the official Ruijie support portal for the release of a security patch addressing the command injection flaw in the RG-EW1800GX firmware.

Proactive Monitoring: Implement strict access control lists to limit who can interact with the device management interface and monitor system logs for suspicious POST requests directed at the networkConnect module.

Compensating Controls: Deploy a Web Application Firewall or network-based intrusion detection system to inspect and filter malicious traffic patterns targeting device management endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research repository referenced in the CVE record.

Given the potential for full system compromise via command injection, administrators should prioritize the deployment of firmware updates as soon as they become available. In the interim, ensure that device management interfaces are not exposed to the public internet and that internal access is restricted to authorized administrative personnel only.