Be50 Firmware
Monthly
OS command injection in the Ruijie RG-EW1300G router firmware (V1.00, V2.00, and V4.00) allows an attacker who holds valid low-privileged credentials on the web management interface to run arbitrary shell commands on the device by sending a crafted POST request that reaches the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua. Exploitation requires network reachability of the management interface plus valid credentials (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N), and publicly available exploit code exists, though the issue is not listed as confirmed actively exploited (CISA KEV). EPSS sits at 2.84% (86th percentile), so the vulnerability warrants prioritized patching but is not an emergency-level, mass-exploitation event.
OS command injection in the Ruijie RG-EW1300G router firmware (V1.00, V2.00, and V4.00) allows an attacker who holds valid low-privileged credentials on the web management interface to run arbitrary shell commands on the device by sending a crafted POST request that reaches the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua. Exploitation requires network reachability of the management interface plus valid credentials (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N), and publicly available exploit code exists, though the issue is not listed as confirmed actively exploited (CISA KEV). EPSS sits at 2.84% (86th percentile), so the vulnerability warrants prioritized patching but is not an emergency-level, mass-exploitation event.