Reyee Os
Monthly
Authenticated OS command injection in Ruijie Reyee OS firmware for wireless bridges and access points - including the RG-YST250F, RG-EST310 V2, RG-EAP602 and related RG-YST/EST series devices running Reyee OS 219/221 builds - allows a low-privilege user who can reach the LuCI web management interface to execute arbitrary shell commands on the device by sending a crafted POST request that abuses the pwdmodify function in /usr/lib/lua/luci/modules/common.lua. Because the injected command runs with the privileges of the web server backend (typically root on these embedded platforms), a successful attacker gains full control of the device's confidentiality, integrity and availability, consistent with the assessed CVSS:3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no CISA KEV listing confirming active exploitation and EPSS is modest at 1.66% (76th percentile), but a public GitHub advisory repository documents the flaw along with reproduction detail, so the issue should be treated as a credible mid-tier priority rather than a critical fire-drill - most urgent for operators who have left the management interface reachable from untrusted networks or who still permit default or weak administrative credentials.
OS command injection in Ruijie wireless access point firmware based on Reyee OS - including RG-YST250F, RG-EST310 v2 and RG-EAP602 builds - lets an authenticated attacker with low-privilege management credentials execute arbitrary operating-system commands on the device via a crafted POST request to the pwdmodify handler in /usr/lib/lua/luci/modules/common.lua. The flaw rates CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), and EPSS is 1.66% (~76th percentile), indicating meaningful but not top-tier exploitation likelihood; no public exploit code or confirmed actively exploited status (CISA KEV) was identified at time of analysis. Practical risk depends heavily on whether the web management interface is exposed beyond a trusted admin VLAN, since valid credentials are a prerequisite.
Authenticated command injection in Ruijie Reyee OS (and the affected RG-EW1800GX PRO, RG-EAP602, RG-EST310 V2 and RG-YST250F firmware builds) lets a low-privileged user who can reach the device's HTTP management interface execute arbitrary OS commands by sending a crafted POST request to the module_set handler backed by /usr/local/lua/dev_sta/nbr_cwmp.lua. Because the vulnerable path is part of the CWMP/TR-069 remote-management module, exposure is concentrated in devices with that service enabled; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C/I/A:H) scores 8.8, reflecting full compromise of confidentiality, integrity and availability once valid credentials are supplied. Exploitation requires network reachability and valid low-privilege authentication rather than being unauthenticated, and reports point to a public technical write-up of the flaw; EPSS is 2.05% (81st percentile), indicating moderate but not top-tier predicted exploitation activity, and no public exploit code has been identified at time of analysis.
OS command injection in Ruijie X30-PRO (firmware X30-PRO-V1_09241521) and related Reyee OS-based Ruijie devices allows an authenticated low-privilege user to execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set parameter processed by /usr/local/lua/dev_sta/nbr_networkId_merge.lua. The issue carries a CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and EPSS of 2.00% (80th percentile), indicating a real but currently modest level of exploitation interest; no CISA KEV listing is present and no public exploit code was identified at time of analysis, so this is a serious but not top-tier emergency. The practical barrier is the required authenticated session on the web/management interface, which means unauthenticated internet-wide exploitation is not indicated.
Authenticated remote attackers with low privileges can execute arbitrary OS commands on Ruijie RG-RAP2200(E) wireless access points running firmware 3.0(1)B11P247 or Reyee OS 2.280.0 by sending a crafted POST request to the module_set handler in /usr/local/lua/dev_sta/nbr_cwmp.lua (CWE-78, CVSS 8.8). Publicly available exploit code exists, including a proof-of-concept write-up on GitHub and mirrored artifacts, though the flaw is not confirmed actively exploited (not in CISA KEV). EPSS sits at 2.84% (86th percentile), indicating elevated but not top-tier near-term exploitation likelihood; the primary exposure limiter is that exploitation requires network reachability to the management/web interface plus valid low-privilege credentials.
The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker message. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in devices executing. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's proxy servers to perform any request the attackers choose. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to subscribe to partial possible topics in Ruijie MQTT broker, and receive partial messages being sent to and. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to obtain the devices serial number if physically adjacent and sniffing the RAW WIFI signal. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credentials to send messages to some topics. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses weak credential mechanism that could allow an attacker to easily calculate MQTT credentials. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a feature that could enable attackers to invalidate a legitimate user's session and cause a denial-of-service attack on a. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which leaves authentication vulnerable to brute force attacks. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could enable an attacker to correlate a device serial number and the user's phone number and part of the email address. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a a feature that could enable sub accounts or attackers to view and exfiltrate sensitive information from all cloud accounts. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authenticated OS command injection in Ruijie Reyee OS firmware for wireless bridges and access points - including the RG-YST250F, RG-EST310 V2, RG-EAP602 and related RG-YST/EST series devices running Reyee OS 219/221 builds - allows a low-privilege user who can reach the LuCI web management interface to execute arbitrary shell commands on the device by sending a crafted POST request that abuses the pwdmodify function in /usr/lib/lua/luci/modules/common.lua. Because the injected command runs with the privileges of the web server backend (typically root on these embedded platforms), a successful attacker gains full control of the device's confidentiality, integrity and availability, consistent with the assessed CVSS:3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no CISA KEV listing confirming active exploitation and EPSS is modest at 1.66% (76th percentile), but a public GitHub advisory repository documents the flaw along with reproduction detail, so the issue should be treated as a credible mid-tier priority rather than a critical fire-drill - most urgent for operators who have left the management interface reachable from untrusted networks or who still permit default or weak administrative credentials.
OS command injection in Ruijie wireless access point firmware based on Reyee OS - including RG-YST250F, RG-EST310 v2 and RG-EAP602 builds - lets an authenticated attacker with low-privilege management credentials execute arbitrary operating-system commands on the device via a crafted POST request to the pwdmodify handler in /usr/lib/lua/luci/modules/common.lua. The flaw rates CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), and EPSS is 1.66% (~76th percentile), indicating meaningful but not top-tier exploitation likelihood; no public exploit code or confirmed actively exploited status (CISA KEV) was identified at time of analysis. Practical risk depends heavily on whether the web management interface is exposed beyond a trusted admin VLAN, since valid credentials are a prerequisite.
Authenticated command injection in Ruijie Reyee OS (and the affected RG-EW1800GX PRO, RG-EAP602, RG-EST310 V2 and RG-YST250F firmware builds) lets a low-privileged user who can reach the device's HTTP management interface execute arbitrary OS commands by sending a crafted POST request to the module_set handler backed by /usr/local/lua/dev_sta/nbr_cwmp.lua. Because the vulnerable path is part of the CWMP/TR-069 remote-management module, exposure is concentrated in devices with that service enabled; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C/I/A:H) scores 8.8, reflecting full compromise of confidentiality, integrity and availability once valid credentials are supplied. Exploitation requires network reachability and valid low-privilege authentication rather than being unauthenticated, and reports point to a public technical write-up of the flaw; EPSS is 2.05% (81st percentile), indicating moderate but not top-tier predicted exploitation activity, and no public exploit code has been identified at time of analysis.
OS command injection in Ruijie X30-PRO (firmware X30-PRO-V1_09241521) and related Reyee OS-based Ruijie devices allows an authenticated low-privilege user to execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set parameter processed by /usr/local/lua/dev_sta/nbr_networkId_merge.lua. The issue carries a CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and EPSS of 2.00% (80th percentile), indicating a real but currently modest level of exploitation interest; no CISA KEV listing is present and no public exploit code was identified at time of analysis, so this is a serious but not top-tier emergency. The practical barrier is the required authenticated session on the web/management interface, which means unauthenticated internet-wide exploitation is not indicated.
Authenticated remote attackers with low privileges can execute arbitrary OS commands on Ruijie RG-RAP2200(E) wireless access points running firmware 3.0(1)B11P247 or Reyee OS 2.280.0 by sending a crafted POST request to the module_set handler in /usr/local/lua/dev_sta/nbr_cwmp.lua (CWE-78, CVSS 8.8). Publicly available exploit code exists, including a proof-of-concept write-up on GitHub and mirrored artifacts, though the flaw is not confirmed actively exploited (not in CISA KEV). EPSS sits at 2.84% (86th percentile), indicating elevated but not top-tier near-term exploitation likelihood; the primary exposure limiter is that exploitation requires network reachability to the management/web interface plus valid low-privilege credentials.
The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker message. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in devices executing. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's proxy servers to perform any request the attackers choose. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to subscribe to partial possible topics in Ruijie MQTT broker, and receive partial messages being sent to and. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to obtain the devices serial number if physically adjacent and sniffing the RAW WIFI signal. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credentials to send messages to some topics. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses weak credential mechanism that could allow an attacker to easily calculate MQTT credentials. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a feature that could enable attackers to invalidate a legitimate user's session and cause a denial-of-service attack on a. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which leaves authentication vulnerable to brute force attacks. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could enable an attacker to correlate a device serial number and the user's phone number and part of the email address. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a a feature that could enable sub accounts or attackers to view and exfiltrate sensitive information from all cloud accounts. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.