Ruijie X60 Pro and RG-EW3200GX Pro OS Command Injection Vulnerability
Vulnerability
An OS command injection vulnerability has been identified in Ruijie X60 Pro (versions X60_10212014RG-X60 Pro V1.00/V2.00) and RG-EW3200GX Pro (ReyeeOS219). This vulnerability allows authenticated remote attackers to execute arbitrary commands on the device by sending specially crafted POST requests to the module_set in the file /usr/local/lua/dev_sta/nbr_cwmp.lua.
Impact
Exploitation of this vulnerability allows for arbitrary command execution on the affected device.
Reproduction
To reproduce this vulnerability, send a POST request to the module_set endpoint in /usr/local/lua/dev_sta/nbr_cwmp.lua with a payload that includes the desired command to be executed on the system.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.