An OS command injection vulnerability in the Ruijie M18 EW_3 router allows authenticated attackers to achieve full system compromise via malicious POST requests.

The flaw exists in the module_set function within the file /usr/local/lua/dev_config/config_retain.lua. It allows an authenticated attacker to inject and execute arbitrary OS commands on the underlying host.

This vulnerability carries a CVSS score of 8.8, reflecting a high risk of total system compromise. Successful exploitation grants an attacker the ability to execute code with elevated privileges, which could lead to unauthorized data access, network lateral movement, or complete denial of service of the affected networking hardware.

Immediate Action: Contact the vendor immediately to obtain firmware updates that address the insecure handling of the module_set parameter, as no public patch is currently confirmed.

Proactive Monitoring: Review system logs for unusual POST requests directed at /usr/local/lua/dev_config/config_retain.lua and monitor for unexpected spawned processes or outbound network traffic from the device.

Compensating Controls: Restrict administrative access to the router interface to trusted management IP addresses and ensure that the device is not reachable from the public internet to prevent unauthorized authentication.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up published on GitHub.

Given the high CVSS score and the presence of a public proof-of-concept, this vulnerability poses a significant risk to network infrastructure. Administrators should prioritize restricting access to the management interface and coordinate with Ruijie support to verify if a firmware update is available for their specific deployment.