A critical OS command injection vulnerability in the Ruijie RG-EW1800GX router allows authenticated attackers to achieve full system compromise via arbitrary command execution.

This flaw is an OS command injection vulnerability located in the file /usr/local/lua/dev_sta/nbr_cwmp.lua. An attacker with low-level privileges can trigger the injection by sending a specially crafted POST request to the module_set function.

The ability to execute arbitrary commands on network infrastructure poses a severe risk to organizational security, potentially leading to unauthorized data exfiltration, lateral movement within the network, or complete denial of service. With a CVSS score of 8.8, this vulnerability represents a high-severity threat that could facilitate the total compromise of the affected device and the traffic passing through it.

Immediate Action: Contact Ruijie support or check the official vendor portal for firmware updates addressing this command injection flaw. Until a patch is verified, restrict access to the device management interface to trusted administrative networks only.

Proactive Monitoring: Monitor system logs for unusual POST requests directed at the nbr_cwmp.lua file or unexpected shell activity originating from the device.

Compensating Controls: Implement strict network segmentation and utilize a Web Application Firewall (WAF) or equivalent inspection tool to filter and block malicious POST requests targeting the identified module_set endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the vulnerability report hosted on GitHub.

Given the high CVSS score and the existence of a public proof-of-concept, this vulnerability warrants immediate attention from network administrators. Organizations should prioritize isolating affected Ruijie devices from public-facing segments and applying vendor-supplied patches as soon as they become available to mitigate the risk of remote command execution.