Ruijie RG-BCR OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in the Ruijie RG-BCR860 model. This vulnerability allows authenticated remote attackers to execute arbitrary commands on the device. The issue arises when specially crafted POST requests are sent to the 'network_set_wan_conf' endpoint, located in the 'luci/controller/admin/netport.lua' file.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the 'network_set_wan_conf' endpoint. The request must be crafted to include the desired commands to be executed on the system. This can be done by an authenticated remote attacker.