Ruijie X30 PRO OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in the Ruijie X30 PRO V1 router. This vulnerability allows attackers to execute arbitrary commands by sending crafted POST requests to a specific Lua script handling network connections. The issue arises from inadequate input validation in the web interface, enabling remote exploitation.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the 'module_get' endpoint of the 'networkConnect.lua' file. The request must be crafted to include the desired commands to be executed on the server.