M18 Ew Firmware
Monthly
OS command injection in Ruijie M18 EW and RG-EW1300G router firmware allows a remote attacker holding a valid low-privilege management session (CVSS PR:L) to run arbitrary OS commands as the device through a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua. The assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) and the independent assessment agree that exploitation is conditional rather than fully unauthenticated: the attacker must first reach the web/management interface and obtain credentials or a session, with exposure highest where remote administration is enabled. Publicly available exploit code exists (a GitHub proof-of-concept/advisory repository), but there is no CISA KEV listing confirming active exploitation, and EPSS is 2.57% (85th percentile), indicating a credible but conditional priority.
Authenticated OS command injection in Ruijie M18 (EW 3.0(1)B11P226) and RG-EW1200R (EW_3.0(1)B11P301) router firmware lets a remote attacker with low-privilege credentials execute arbitrary commands on the device by sending a crafted POST request to the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua. Publicly available exploit code exists (a GitHub vulnerability report with technical details), though there is no CISA KEV confirmation of active exploitation; EPSS estimates a 2.76% chance of exploitation within 30 days (86th percentile). Exploitation requires network reachability to the router's web management interface and valid low-privilege credentials, but default or weak SOHO router passwords may lower that barrier, making this a credible moderately-high priority issue.
Authenticated OS command injection in Ruijie M18 EW_3.0(1)B11P226 firmware (with the same code path in RG-EW300G Pro EW_3.0(1)B11P219) lets a low-privileged authenticated attacker execute arbitrary shell commands on the device by sending a crafted POST request to the module_set function in /usr/local/lua/dev_sta/nbr_cwmp.lua. Exploitation requires network reachability to the device management interface plus valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N, score 8.8), and no user interaction is needed. Publicly available exploit code exists and the EPSS score is 2.84% (86th percentile), so risk is real but this is a credible, not top-tier emergency, priority - exposure drops sharply for devices whose management UI is not reachable from untrusted networks.
OS command injection in Ruijie M18 EW and RG-EW1300G router firmware allows a remote attacker holding a valid low-privilege management session (CVSS PR:L) to run arbitrary OS commands as the device through a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua. The assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) and the independent assessment agree that exploitation is conditional rather than fully unauthenticated: the attacker must first reach the web/management interface and obtain credentials or a session, with exposure highest where remote administration is enabled. Publicly available exploit code exists (a GitHub proof-of-concept/advisory repository), but there is no CISA KEV listing confirming active exploitation, and EPSS is 2.57% (85th percentile), indicating a credible but conditional priority.
Authenticated OS command injection in Ruijie M18 (EW 3.0(1)B11P226) and RG-EW1200R (EW_3.0(1)B11P301) router firmware lets a remote attacker with low-privilege credentials execute arbitrary commands on the device by sending a crafted POST request to the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua. Publicly available exploit code exists (a GitHub vulnerability report with technical details), though there is no CISA KEV confirmation of active exploitation; EPSS estimates a 2.76% chance of exploitation within 30 days (86th percentile). Exploitation requires network reachability to the router's web management interface and valid low-privilege credentials, but default or weak SOHO router passwords may lower that barrier, making this a credible moderately-high priority issue.
Authenticated OS command injection in Ruijie M18 EW_3.0(1)B11P226 firmware (with the same code path in RG-EW300G Pro EW_3.0(1)B11P219) lets a low-privileged authenticated attacker execute arbitrary shell commands on the device by sending a crafted POST request to the module_set function in /usr/local/lua/dev_sta/nbr_cwmp.lua. Exploitation requires network reachability to the device management interface plus valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N, score 8.8), and no user interaction is needed. Publicly available exploit code exists and the EPSS score is 2.84% (86th percentile), so risk is real but this is a credible, not top-tier emergency, priority - exposure drops sharply for devices whose management UI is not reachable from untrusted networks.