Ruijie X30-PRO OS Command Injection Vulnerability

A command injection vulnerability has been identified in the Ruijie X30-PRO access point, specifically in the X30-PRO-V1_09241521 version. This vulnerability allows authenticated remote attackers to execute arbitrary commands on the device by sending specially crafted POST requests to the 'setWisp' function in the '/usr/lib/lua/luci/modules/wireless.lua' file.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the 'setWisp' endpoint with a payload that includes the desired command to be executed. This can be done using a tool like curl or Postman, ensuring that the request is authenticated.