Ruijie RG-BCR OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in the Ruijie RG-BCR600W model. This vulnerability allows authenticated remote attackers to execute arbitrary commands on the device. The issue arises when specially crafted POST requests are sent to the 'run_tcpdump' function in the file '/usr/lib/lua/luci/controller/admin/common_tcpdump.lua'.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the 'run_tcpdump' endpoint with a payload that includes the desired command to be executed. The request must be crafted to exploit the command injection flaw, bypassing any input validation or sanitization.