Ruijie Networks X60 and RG-EW1200 OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in Ruijie Networks X60 PRO (versions X60_10212014RG-X60 PRO V1.00 and V2.00) and the RG-EW1200 running ReyeeOS301. This vulnerability allows authenticated remote attackers to execute arbitrary commands on the affected device by sending specially crafted POST requests to the 'module_set' in the 'config_retain.lua' file.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the 'module_set' endpoint in the 'config_retain.lua' file. The request must be crafted to include the desired commands for execution. This can be done using a tool like curl or Postman, ensuring that the request is sent with the appropriate authentication.