Ruijie X30-PRO and RG-EW300 PRO OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in Ruijie X30-PRO (version X30-PRO-V1_09241521) and RG-EW300 PRO (ReyeeOS219). This vulnerability allows authenticated remote attackers to execute arbitrary commands on the device by sending specially crafted POST requests to the 'module_get' endpoint in the 'host_access_delay.lua' file.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the 'module_get' endpoint in the 'host_access_delay.lua' file. The request must be crafted to include the desired commands to be executed on the system.