Ruijie RG-BCR OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in the Ruijie RG-BCR600W model. This vulnerability allows authenticated remote attackers to execute arbitrary commands on the device. The issue arises when specially crafted POST requests are sent to the submit_wifi endpoint, located in the Lua controller for quick configuration.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of system commands on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the submit_wifi endpoint in the common_quick_config.lua file. The request must be crafted to include the desired commands for execution.