An OS command injection vulnerability in Ruijie X60 PRO firmware versions V1.00 and V2.00 poses a significant risk of total system compromise through unauthorized command execution.

This vulnerability is an OS command injection flaw located in the /usr/local/lua/dev_sta/networkConnect.lua file. An attacker with low-level local privileges can trigger the execution of arbitrary system commands by sending a specially crafted POST request to the module_get endpoint.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with the privileges of the underlying service, potentially leading to full control over the affected networking hardware. With a CVSS score of 7.8, this flaw represents a high-severity risk that could facilitate lateral movement within the network, unauthorized data access, or the disruption of critical communication services.

Immediate Action: Since a vendor patch is currently unknown, administrators should restrict network access to the management interface and monitor the device for suspicious traffic. Contact Ruijie support directly to inquire about a firmware update that addresses this specific command injection vulnerability.

Proactive Monitoring: Review system logs for unusual POST requests directed at the networkConnect.lua file or any unexpected execution of shell commands.

Compensating Controls: Implement strict network access control lists to ensure that only authorized administrative workstations can communicate with the device management interface, effectively mitigating the risk of exploitation by unauthorized local users.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the researcher's technical write-up on GitHub.

Given the high CVSS score and the public availability of technical details regarding the exploit, this vulnerability must be treated with urgency. Administrators should prioritize isolating the affected Ruijie X60 PRO devices from untrusted segments and maintain close communication with the vendor for official patch releases to remediate this command injection flaw permanently.