An OS command injection vulnerability in Ruijie RG-BCR860 devices poses a high risk of total system compromise for organizations failing to restrict administrative access.

The vulnerability is an OS command injection flaw located within the network_set_wan_conf function of the Lua controller file. Based on the CVSS vector (PR:L), this vulnerability requires the attacker to have low-level administrative credentials to successfully trigger the command execution.

Successful exploitation allows an attacker to execute arbitrary commands on the underlying operating system of the network device. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to full device takeover, enabling lateral movement within the network, unauthorized interception of traffic, or complete denial of service.

Immediate Action: Contact Ruijie support or monitor the vendor portal for the release of a security patch addressing this command injection flaw.

Proactive Monitoring: Review device access logs for suspicious POST requests directed at the network_set_wan_conf endpoint, particularly those containing shell metacharacters.

Compensating Controls: Restrict access to the device management interface to trusted administrative IP addresses only, and implement network segmentation to isolate the management plane from general user traffic.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the research write-up hosted on GitHub.

The severity of this vulnerability necessitates immediate attention from network administrators. Until a vendor patch is applied, organizations must ensure that administrative interfaces are not exposed to the public internet and that access is strictly limited to authorized personnel to prevent exploitation of this command injection vector.