Ruijie RG-BCR OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in the Ruijie RG-BCR600W model. This vulnerability allows authenticated remote attackers to execute arbitrary commands on the device. The issue arises in the Lua controller for the admin common module, specifically through crafted POST requests to the get_wanobj endpoint.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the get_wanobj endpoint in the Lua controller for admin common. The request must be crafted to include the desired commands for execution. This can be done using a tool like Burp Suite or by writing a custom script that sends the appropriate request.