An OS command injection vulnerability in Ruijie RG-BCR series devices allows authenticated attackers to execute arbitrary code, posing a critical risk to network integrity and system control.

The vulnerability is an OS command injection flaw located in the get_wanobj function within the common.lua controller file. Successful exploitation requires the attacker to have low-level administrative privileges, as indicated by the CVSS vector PR:L, to interact with the vulnerable endpoint.

The ability for an attacker to execute arbitrary commands on network infrastructure devices carries a high risk of full system compromise. Given the CVSS score of 8.8, this vulnerability could lead to unauthorized network access, data exfiltration, or complete device takeover, potentially resulting in significant operational downtime and severe security breaches.

Immediate Action: Contact the vendor or consult the official support portal to identify and apply the latest security firmware updates for the affected hardware.

Proactive Monitoring: Review system access logs for anomalous POST requests directed at the get_wanobj path and monitor for unexpected spawned processes originating from the web management interface.

Compensating Controls: Restrict administrative access to the management interface by utilizing network segmentation or an access control list (ACL) to ensure only authorized internal management IP addresses can reach the device.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the security researcher's technical report linked in the CVE record.

Due to the high severity of this command injection vulnerability, organizations using the Ruijie RG-BCR series must treat this as a priority. Administrators should restrict access to the management interface immediately as a stopgap measure and coordinate with the vendor to deploy the necessary patches to remediate the flaw permanently.