Rg Bcr600W Firmware
Monthly
OS command injection in the Ruijie RG-BCR600W router firmware (build 1.0.4.4468) lets an attacker who already holds valid low-privilege credentials execute arbitrary shell commands on the device by sending a crafted POST request to the get_wanobj handler in /usr/lib/lua/luci/controller/admin/common.lua. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N) and carries an EPSS score of roughly 3.14% (88th percentile), and publicly available exploit code exists - though no CISA KEV entry confirms active exploitation. Exploitation is conditional rather than anonymous: the attacker must be able to reach the web management interface and authenticate, so risk rises sharply wherever the admin panel is exposed beyond the LAN or default credentials remain in place.
OS command injection in the Ruijie RG-BCR600W router firmware allows an attacker who holds a low-privilege authenticated session on the web management interface to run arbitrary operating-system commands by sending a crafted POST request to the submit_wifi action handled by /usr/lib/lua/luci/controller/admin/common_quick_config.lua. Successful exploitation yields full compromise of confidentiality, integrity, and availability of the device (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the practical risk is highest where the admin panel is reachable from the internet or an untrusted LAN segment and where default or weak credentials remain in place. EPSS sits at roughly 2.25% (83rd percentile), indicating elevated relative attention but not a mass-exploitation event, and no public exploit identified at time of analysis; this is a credible above-average priority for operators of the affected hardware rather than an emergency.
Authenticated OS command injection in the Ruijie RG-BCR600W router firmware allows a logged-in, low-privilege user to run arbitrary shell commands on the device by sending a crafted POST request to the restart_modules action implemented in /usr/lib/lua/luci/controller/admin/common.lua. The issue is rated CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and classified CWE-78, with EPSS at 1.98% (~80th percentile) indicating a modest but non-trivial likelihood of exploitation attempts in the wild. Exploitation is not pre-authentication: attackers must first reach the web management interface and hold valid low-privilege credentials, so exposure hinges on whether the device's admin plane is reachable from untrusted networks; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Authenticated command injection in Ruijie RG-BCR600W firmware allows low-privileged users to execute arbitrary OS commands by sending a crafted POST request to the run_tcpdump action in the LuCI web interface. Exploitation requires network access to the device's management interface and a valid low-privilege session (CVSS PR:L), with risk magnified by default or weak credentials. EPSS is 2.44% (84th percentile), indicating elevated but not critical risk; no active exploitation in CISA KEV and no public exploit code identified at time of analysis.
Authenticated OS command injection in the Ruijie RG-BCR600W branch/SOHO router allows a remote attacker who already holds valid management credentials to execute arbitrary operating-system commands on the device by sending a crafted POST request to the check_changes action handled by /usr/lib/lua/luci/controller/admin/common.lua. Successful exploitation yields full compromise of confidentiality, integrity and availability of the router (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). The attack is not viable against devices whose LuCI web management interface is unreachable or protected by strong credentials, but risk rises sharply where the UI is exposed to untrusted networks or still uses default/weak logins; EPSS is 2.38% (84th percentile) and no public exploit code has been identified at time of analysis, with no CISA KEV listing.
OS command injection in the Ruijie RG-BCR600W router firmware (build 1.0.4.4468) lets an attacker who already holds valid low-privilege credentials execute arbitrary shell commands on the device by sending a crafted POST request to the get_wanobj handler in /usr/lib/lua/luci/controller/admin/common.lua. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N) and carries an EPSS score of roughly 3.14% (88th percentile), and publicly available exploit code exists - though no CISA KEV entry confirms active exploitation. Exploitation is conditional rather than anonymous: the attacker must be able to reach the web management interface and authenticate, so risk rises sharply wherever the admin panel is exposed beyond the LAN or default credentials remain in place.
OS command injection in the Ruijie RG-BCR600W router firmware allows an attacker who holds a low-privilege authenticated session on the web management interface to run arbitrary operating-system commands by sending a crafted POST request to the submit_wifi action handled by /usr/lib/lua/luci/controller/admin/common_quick_config.lua. Successful exploitation yields full compromise of confidentiality, integrity, and availability of the device (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the practical risk is highest where the admin panel is reachable from the internet or an untrusted LAN segment and where default or weak credentials remain in place. EPSS sits at roughly 2.25% (83rd percentile), indicating elevated relative attention but not a mass-exploitation event, and no public exploit identified at time of analysis; this is a credible above-average priority for operators of the affected hardware rather than an emergency.
Authenticated OS command injection in the Ruijie RG-BCR600W router firmware allows a logged-in, low-privilege user to run arbitrary shell commands on the device by sending a crafted POST request to the restart_modules action implemented in /usr/lib/lua/luci/controller/admin/common.lua. The issue is rated CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and classified CWE-78, with EPSS at 1.98% (~80th percentile) indicating a modest but non-trivial likelihood of exploitation attempts in the wild. Exploitation is not pre-authentication: attackers must first reach the web management interface and hold valid low-privilege credentials, so exposure hinges on whether the device's admin plane is reachable from untrusted networks; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Authenticated command injection in Ruijie RG-BCR600W firmware allows low-privileged users to execute arbitrary OS commands by sending a crafted POST request to the run_tcpdump action in the LuCI web interface. Exploitation requires network access to the device's management interface and a valid low-privilege session (CVSS PR:L), with risk magnified by default or weak credentials. EPSS is 2.44% (84th percentile), indicating elevated but not critical risk; no active exploitation in CISA KEV and no public exploit code identified at time of analysis.
Authenticated OS command injection in the Ruijie RG-BCR600W branch/SOHO router allows a remote attacker who already holds valid management credentials to execute arbitrary operating-system commands on the device by sending a crafted POST request to the check_changes action handled by /usr/lib/lua/luci/controller/admin/common.lua. Successful exploitation yields full compromise of confidentiality, integrity and availability of the router (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). The attack is not viable against devices whose LuCI web management interface is unreachable or protected by strong credentials, but risk rises sharply where the UI is exposed to untrusted networks or still uses default/weak logins; EPSS is 2.38% (84th percentile) and no public exploit code has been identified at time of analysis, with no CISA KEV listing.