The Ruijie X30-PRO router is susceptible to an OS command injection vulnerability that allows authenticated attackers to achieve full system compromise.

This vulnerability is an OS command injection flaw located in the pwdmodify function within the common.lua file. It requires the attacker to have low-level privileges to successfully submit a crafted POST request that triggers the execution of arbitrary commands.

Successful exploitation of this vulnerability leads to full system compromise, granting an attacker the ability to execute arbitrary code with the privileges of the web server. Given the CVSS score of 8.8, this represents a high risk to business operations, as it could facilitate unauthorized data access, network lateral movement, or the complete disruption of network services provided by the device.

Immediate Action: Contact the vendor to verify the availability of a firmware update that addresses this command injection flaw and apply it immediately upon release.

Proactive Monitoring: Monitor device access logs for suspicious POST requests targeting the pwdmodify endpoint and investigate any unexpected system process executions.

Compensating Controls: Restrict administrative access to the device management interface to trusted internal IP addresses only, and employ a Web Application Firewall (WAF) to inspect traffic for common command injection patterns.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research repository hosted on GitHub.

Given the high severity of this vulnerability and the potential for full device takeover, organizations utilizing the Ruijie X30-PRO must treat this as a critical security priority. Administrators should restrict management access to the device immediately and prioritize the deployment of a vendor-supplied firmware patch as soon as it becomes available.