An OS command injection vulnerability in Ruijie RG-BCR860 devices poses a critical risk of full system compromise for authenticated users.

This is an OS command injection vulnerability triggered by sending a malicious POST request to the action_wireless function located in the administration interface file /usr/lib/lua/luci/control/admin/wireless.lua. Per the CVSS vector PR:L, this vulnerability requires the attacker to have low-level authenticated access to the device.

Successful exploitation allows an attacker to execute arbitrary commands at the operating system level with administrative privileges. This effectively grants the attacker full control over the network appliance, potentially leading to unauthorized data exfiltration, lateral movement within the network, and complete service disruption. With a CVSS score of 8.8, this flaw represents a high-severity risk that demands immediate attention to maintain network integrity.

Immediate Action: Contact Ruijie support or check the official vendor portal for the latest firmware release that addresses this command injection flaw.

Proactive Monitoring: Inspect system logs for unusual POST requests directed at the wireless administration scripts and monitor for unexpected outbound network traffic originating from the device.

Compensating Controls: Restrict access to the device management interface to trusted administrative IP addresses only, and utilize a Web Application Firewall (WAF) to filter malicious payloads in POST requests.

Public Exploit Available: Yes — a published proof-of-concept exists as detailed in the technical report hosted on GitHub.

Given the potential for remote code execution and the availability of a public proof-of-concept, users must treat this vulnerability with high priority. Organizations should immediately audit their Ruijie infrastructure for exposure and implement strict access controls on the management interface until an official patch is verified and applied.