An OS command injection vulnerability in Ruijie X30-PRO firmware allows authenticated remote attackers to achieve full system compromise.

The flaw exists in the processing of POST requests within the /usr/local/lua/dev_sta/nbr_cwmp.lua file. By injecting malicious input into the module_set parameter, an authenticated attacker can trigger arbitrary OS command execution with high privileges.

Successful exploitation of this vulnerability grants an attacker complete control over the affected network device. This poses a severe risk to organizational security, as it facilitates lateral movement, potential interception of network traffic, and the establishment of persistent backdoors within the network infrastructure. With a CVSS score of 8.8, this vulnerability is considered high severity due to the high impact on confidentiality, integrity, and availability.

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict management access to the device to trusted IP addresses only and disable remote administration features if they are not strictly required.

Proactive Monitoring: Monitor device access logs for suspicious POST requests directed at the module_set endpoint or unusual outbound traffic originating from the router that may indicate command-and-control communication.

Compensating Controls: Deploy a Web Application Firewall or network-based intrusion detection system rules to filter and block malformed or suspicious POST requests targeting the device management interface.

Public Exploit Available: Yes, a technical write-up containing attack details and proof-of-concept information is available via the referenced GitHub repository.

Given the potential for total system compromise, organizations currently utilizing the Ruijie X30-PRO should prioritize network isolation for these devices. Ensure that management interfaces are not exposed to the public internet and maintain rigorous monitoring for any unauthorized configuration changes or anomalous activity until a vendor-supplied firmware update is released and applied.