Ruijie X30-PRO OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in the Ruijie X30-PRO device, specifically in the version X30-PRO-V1_09241521. This vulnerability allows authenticated remote attackers to execute arbitrary commands on the device by sending specially crafted POST requests to the module_set in the file /usr/local/lua/dev_sta/nbr_cwmp.lua.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the module_set endpoint in the file /usr/local/lua/dev_sta/nbr_cwmp.lua. The request must be crafted to include the desired commands for execution.