A critical OS command injection vulnerability in the Ruijie RG-EW1800GX PRO router allows authenticated attackers to achieve full system compromise via arbitrary command execution.

The device is susceptible to OS command injection through the module_get function within the /usr/local/lua/dev_sta/networkConnect.lua file. The vulnerability requires the attacker to have established authenticated access to the device to submit a crafted POST request.

Successful exploitation of this vulnerability permits an attacker to execute arbitrary commands on the underlying operating system with elevated privileges. This results in a total compromise of the device, potentially allowing for lateral movement within the network, traffic interception, or permanent denial of service. The CVSS score of 8.8 reflects the high severity of this flaw, as it grants complete control over the affected hardware.

Immediate Action: Contact Ruijie support immediately to verify if a firmware update is available for this specific build, as no public patch is currently confirmed.

Proactive Monitoring: Inspect system logs for unusual POST requests directed at the networkConnect module or unexpected execution of shell commands originating from the web management interface.

Compensating Controls: Restrict access to the device management interface to trusted administrative IP addresses only, and disable remote management features if they are not strictly required for business operations.

Public Exploit Available: Yes, a public proof-of-concept exists via the technical write-up published on GitHub.

Given the potential for total system compromise, administrators must prioritize the protection of the management interface. If a vendor-supplied patch is not available, isolate the device from untrusted networks immediately to prevent unauthorized access. Monitor for any signs of exploitation until a verified firmware update can be applied.