Ruijie RG-BCR OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in the Ruijie RG-BCR860 model. This vulnerability allows authenticated remote attackers to execute arbitrary commands on the device. The issue arises in the Lua-based web interface, specifically within the 'api/rcmsAPI.lua' file. Exploitation involves sending crafted POST requests to a vulnerable endpoint.

Impact

Successful exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the 'action_deal_update' endpoint in the 'api/rcmsAPI.lua' file. The request must be crafted to include the desired commands for execution. This can be done using tools like curl or Postman, ensuring that the request is sent with the appropriate authentication.