Ruijie RG-BCR OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in the Ruijie RG-BCR600W model. This vulnerability allows authenticated remote attackers to execute arbitrary commands on the device. The issue arises from the handling of POST requests by the Lua service, specifically in the 'check_changes' function of the 'common.lua' file.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a crafted POST request to the 'check_changes' endpoint. The request must be designed to exploit the command injection flaw, allowing arbitrary system commands to be executed on the device.