Ruijie X30-PRO OS Command Injection Vulnerability

A command injection vulnerability has been identified in the Ruijie X30-PRO device, specifically in the X30-PRO-V1_09241521 version. This vulnerability allows authenticated remote attackers to execute arbitrary commands on the system. The issue arises in the Lua service, where crafted POST requests can be used to exploit the vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the 'pwdmodify' endpoint in the '/usr/lib/lua/luci/modules/common.lua' file. The request must be crafted to include the desired commands for execution.