Ruijie access points running firmware version 11.1.x are vulnerable to authenticated command injection, which permits full system compromise.

This vulnerability involves an append-style command injection within the web_action.do endpoint, allowing an authenticated web user to execute shell expressions with root privileges. This grants the attacker the ability to perform file disclosure, disrupt device operations, and facilitate network pivoting.

Successful exploitation allows an attacker to gain full administrative control over the affected access points, leading to potential unauthorized access to internal network traffic. Given the CVSS score of 7.2, this flaw presents a high risk to network integrity and confidentiality, as compromised access points can serve as a persistent foothold for further lateral movement within the environment.

Immediate Action: Contact Ruijie support or monitor the official vendor security portal for the release of a firmware update that addresses this command injection flaw.

Proactive Monitoring: Review web access logs for suspicious input strings directed at the web_action.do endpoint, specifically looking for shell-related characters or unusual command parameters.

Compensating Controls: Restrict administrative access to the web management interface of the access points to trusted management IP addresses only, and enforce strong authentication policies to minimize the risk of unauthorized account access.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the security advisory referenced by the researcher.

This vulnerability represents a significant security risk to network infrastructure because it grants root-level access to critical network hardware. Organizations should prioritize restricting administrative access to these devices immediately and apply the necessary firmware patches as soon as they are made available by Ruijie to prevent potential network compromise.