An OS command injection vulnerability exists in the Ruijie X60 PRO firmware that allows authenticated attackers to achieve full system compromise.

This vulnerability is an OS command injection flaw located in the module_set function within the /usr/local/lua/dev_config/config_retain.lua file. It allows an attacker with low-level privileges to execute arbitrary system commands by sending a maliciously crafted POST request.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the underlying operating system. This could lead to a complete loss of confidentiality, integrity, and availability, enabling the attacker to pivot into the internal network or disrupt critical communication services. With a CVSS score of 8.8, this flaw represents a high risk to organizational infrastructure.

Immediate Action: Restrict access to the management interface of the Ruijie X60 PRO to trusted internal networks only and monitor for vendor-provided firmware updates.

Proactive Monitoring: Review device access logs and network traffic for suspicious POST requests targeting the /usr/local/lua/dev_config/config_retain.lua endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent network inspection tool to filter and block POST requests containing shell metacharacters or unauthorized command strings directed at the management module.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up referenced by the CVE record.

Given the high CVSS score and the existence of a public proof-of-concept, administrators should prioritize securing affected devices immediately. Until a vendor patch is released and verified, ensure that the management interface is not exposed to the internet and audit all user accounts with administrative access to prevent unauthorized utilization of this injection vector.