Rg Eap602 Firmware
Monthly
Authenticated OS command injection in Ruijie Reyee OS firmware for wireless bridges and access points - including the RG-YST250F, RG-EST310 V2, RG-EAP602 and related RG-YST/EST series devices running Reyee OS 219/221 builds - allows a low-privilege user who can reach the LuCI web management interface to execute arbitrary shell commands on the device by sending a crafted POST request that abuses the pwdmodify function in /usr/lib/lua/luci/modules/common.lua. Because the injected command runs with the privileges of the web server backend (typically root on these embedded platforms), a successful attacker gains full control of the device's confidentiality, integrity and availability, consistent with the assessed CVSS:3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no CISA KEV listing confirming active exploitation and EPSS is modest at 1.66% (76th percentile), but a public GitHub advisory repository documents the flaw along with reproduction detail, so the issue should be treated as a credible mid-tier priority rather than a critical fire-drill - most urgent for operators who have left the management interface reachable from untrusted networks or who still permit default or weak administrative credentials.
Authenticated OS command injection in Ruijie X30-PRO wireless routers and related Ruijie wireless firmware (RG-EAP602, RG-EST350, RG-EW300 PRO, RG-EST310) allows a low-privileged, logged-in user to execute arbitrary system commands by sending a crafted POST request to the pwdmodify handler implemented in /usr/lib/lua/luci/modules/common.lua. The issue is rated CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), and publicly available exploit code exists - including a dedicated GitHub vulnerability report (flegoity) and accompanying proof-of-concept links - while EPSS sits at 2.66% (roughly the 85th percentile), indicating elevated relative likelihood rather than confirmed active exploitation. Risk concentrates on devices whose web management interface is reachable from untrusted networks; LAN-only or firewalled management interfaces substantially reduce exposure.
OS command injection in Ruijie wireless access point firmware based on Reyee OS - including RG-YST250F, RG-EST310 v2 and RG-EAP602 builds - lets an authenticated attacker with low-privilege management credentials execute arbitrary operating-system commands on the device via a crafted POST request to the pwdmodify handler in /usr/lib/lua/luci/modules/common.lua. The flaw rates CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), and EPSS is 1.66% (~76th percentile), indicating meaningful but not top-tier exploitation likelihood; no public exploit code or confirmed actively exploited status (CISA KEV) was identified at time of analysis. Practical risk depends heavily on whether the web management interface is exposed beyond a trusted admin VLAN, since valid credentials are a prerequisite.
Authenticated OS command injection in Ruijie RG-EW1200G PRO routers running firmware V1.00, V2.00, V3.00 or V4.00 lets a remote attacker with low-privilege credentials execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set action handled in /usr/local/lua/dev_sta/nbr_cwmp.lua. Publicly available exploit code exists (a GitHub vulnerability report plus linked OneDrive proof-of-concept artifacts), and EPSS rates the flaw at 2.76% (86th percentile), but it is not listed in CISA KEV, so active exploitation is not confirmed. Because the CVSS vector is AV:N/PR:L/UI:N with high C/I/A impact, the attacker must first reach the router's management interface and hold valid (even low-level) credentials, meaning LAN-restricted management and strong unique credentials materially reduce exposure.
OS command injection in Ruijie X30-PRO firmware (build X30-PRO-V1_09241521) and related RG-EW300 PRO and RG-EAP602 builds allows an authenticated, low-privilege attacker who can reach the LuCI web management interface to execute arbitrary OS commands through a crafted POST request to the setWisp endpoint handled by /usr/lib/lua/luci/modules/wireless.lua. Publicly available exploit code exists, and EPSS rates the issue at 3.15% (88th percentile), though CISA KEV does not list it as confirmed actively exploited. Successful exploitation yields full confidentiality, integrity, and availability impact on the device (CVSS 8.8), and the practical risk is amplified because SOHO/SMB devices frequently ship with default or weak credentials and may expose management over LAN or WAN.
Authenticated command injection in Ruijie Reyee OS (and the affected RG-EW1800GX PRO, RG-EAP602, RG-EST310 V2 and RG-YST250F firmware builds) lets a low-privileged user who can reach the device's HTTP management interface execute arbitrary OS commands by sending a crafted POST request to the module_set handler backed by /usr/local/lua/dev_sta/nbr_cwmp.lua. Because the vulnerable path is part of the CWMP/TR-069 remote-management module, exposure is concentrated in devices with that service enabled; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C/I/A:H) scores 8.8, reflecting full compromise of confidentiality, integrity and availability once valid credentials are supplied. Exploitation requires network reachability and valid low-privilege authentication rather than being unauthenticated, and reports point to a public technical write-up of the flaw; EPSS is 2.05% (81st percentile), indicating moderate but not top-tier predicted exploitation activity, and no public exploit code has been identified at time of analysis.
OS command injection in Ruijie X30-PRO (firmware X30-PRO-V1_09241521) and related Reyee OS-based Ruijie devices allows an authenticated low-privilege user to execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set parameter processed by /usr/local/lua/dev_sta/nbr_networkId_merge.lua. The issue carries a CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and EPSS of 2.00% (80th percentile), indicating a real but currently modest level of exploitation interest; no CISA KEV listing is present and no public exploit code was identified at time of analysis, so this is a serious but not top-tier emergency. The practical barrier is the required authenticated session on the web/management interface, which means unauthenticated internet-wide exploitation is not indicated.
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated OS command injection in Ruijie Reyee OS firmware for wireless bridges and access points - including the RG-YST250F, RG-EST310 V2, RG-EAP602 and related RG-YST/EST series devices running Reyee OS 219/221 builds - allows a low-privilege user who can reach the LuCI web management interface to execute arbitrary shell commands on the device by sending a crafted POST request that abuses the pwdmodify function in /usr/lib/lua/luci/modules/common.lua. Because the injected command runs with the privileges of the web server backend (typically root on these embedded platforms), a successful attacker gains full control of the device's confidentiality, integrity and availability, consistent with the assessed CVSS:3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no CISA KEV listing confirming active exploitation and EPSS is modest at 1.66% (76th percentile), but a public GitHub advisory repository documents the flaw along with reproduction detail, so the issue should be treated as a credible mid-tier priority rather than a critical fire-drill - most urgent for operators who have left the management interface reachable from untrusted networks or who still permit default or weak administrative credentials.
Authenticated OS command injection in Ruijie X30-PRO wireless routers and related Ruijie wireless firmware (RG-EAP602, RG-EST350, RG-EW300 PRO, RG-EST310) allows a low-privileged, logged-in user to execute arbitrary system commands by sending a crafted POST request to the pwdmodify handler implemented in /usr/lib/lua/luci/modules/common.lua. The issue is rated CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), and publicly available exploit code exists - including a dedicated GitHub vulnerability report (flegoity) and accompanying proof-of-concept links - while EPSS sits at 2.66% (roughly the 85th percentile), indicating elevated relative likelihood rather than confirmed active exploitation. Risk concentrates on devices whose web management interface is reachable from untrusted networks; LAN-only or firewalled management interfaces substantially reduce exposure.
OS command injection in Ruijie wireless access point firmware based on Reyee OS - including RG-YST250F, RG-EST310 v2 and RG-EAP602 builds - lets an authenticated attacker with low-privilege management credentials execute arbitrary operating-system commands on the device via a crafted POST request to the pwdmodify handler in /usr/lib/lua/luci/modules/common.lua. The flaw rates CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), and EPSS is 1.66% (~76th percentile), indicating meaningful but not top-tier exploitation likelihood; no public exploit code or confirmed actively exploited status (CISA KEV) was identified at time of analysis. Practical risk depends heavily on whether the web management interface is exposed beyond a trusted admin VLAN, since valid credentials are a prerequisite.
Authenticated OS command injection in Ruijie RG-EW1200G PRO routers running firmware V1.00, V2.00, V3.00 or V4.00 lets a remote attacker with low-privilege credentials execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set action handled in /usr/local/lua/dev_sta/nbr_cwmp.lua. Publicly available exploit code exists (a GitHub vulnerability report plus linked OneDrive proof-of-concept artifacts), and EPSS rates the flaw at 2.76% (86th percentile), but it is not listed in CISA KEV, so active exploitation is not confirmed. Because the CVSS vector is AV:N/PR:L/UI:N with high C/I/A impact, the attacker must first reach the router's management interface and hold valid (even low-level) credentials, meaning LAN-restricted management and strong unique credentials materially reduce exposure.
OS command injection in Ruijie X30-PRO firmware (build X30-PRO-V1_09241521) and related RG-EW300 PRO and RG-EAP602 builds allows an authenticated, low-privilege attacker who can reach the LuCI web management interface to execute arbitrary OS commands through a crafted POST request to the setWisp endpoint handled by /usr/lib/lua/luci/modules/wireless.lua. Publicly available exploit code exists, and EPSS rates the issue at 3.15% (88th percentile), though CISA KEV does not list it as confirmed actively exploited. Successful exploitation yields full confidentiality, integrity, and availability impact on the device (CVSS 8.8), and the practical risk is amplified because SOHO/SMB devices frequently ship with default or weak credentials and may expose management over LAN or WAN.
Authenticated command injection in Ruijie Reyee OS (and the affected RG-EW1800GX PRO, RG-EAP602, RG-EST310 V2 and RG-YST250F firmware builds) lets a low-privileged user who can reach the device's HTTP management interface execute arbitrary OS commands by sending a crafted POST request to the module_set handler backed by /usr/local/lua/dev_sta/nbr_cwmp.lua. Because the vulnerable path is part of the CWMP/TR-069 remote-management module, exposure is concentrated in devices with that service enabled; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C/I/A:H) scores 8.8, reflecting full compromise of confidentiality, integrity and availability once valid credentials are supplied. Exploitation requires network reachability and valid low-privilege authentication rather than being unauthenticated, and reports point to a public technical write-up of the flaw; EPSS is 2.05% (81st percentile), indicating moderate but not top-tier predicted exploitation activity, and no public exploit code has been identified at time of analysis.
OS command injection in Ruijie X30-PRO (firmware X30-PRO-V1_09241521) and related Reyee OS-based Ruijie devices allows an authenticated low-privilege user to execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set parameter processed by /usr/local/lua/dev_sta/nbr_networkId_merge.lua. The issue carries a CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and EPSS of 2.00% (80th percentile), indicating a real but currently modest level of exploitation interest; no CISA KEV listing is present and no public exploit code was identified at time of analysis, so this is a serious but not top-tier emergency. The practical barrier is the required authenticated session on the web/management interface, which means unauthenticated internet-wide exploitation is not indicated.
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.