Rg Est350 Firmware
Monthly
Authenticated OS command injection in Ruijie X30-PRO wireless routers and related Ruijie wireless firmware (RG-EAP602, RG-EST350, RG-EW300 PRO, RG-EST310) allows a low-privileged, logged-in user to execute arbitrary system commands by sending a crafted POST request to the pwdmodify handler implemented in /usr/lib/lua/luci/modules/common.lua. The issue is rated CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), and publicly available exploit code exists - including a dedicated GitHub vulnerability report (flegoity) and accompanying proof-of-concept links - while EPSS sits at 2.66% (roughly the 85th percentile), indicating elevated relative likelihood rather than confirmed active exploitation. Risk concentrates on devices whose web management interface is reachable from untrusted networks; LAN-only or firewalled management interfaces substantially reduce exposure.
Authenticated OS command injection in Ruijie RG-EW1800GX firmware build B11P226_EW1800GX_10223121 (and, per CPE data, the RG-EST350 build 3.0(1)B11P221) lets remote attackers who already hold a low-privilege session execute arbitrary shell commands on the device by sending a crafted POST request to the module_set endpoint handled by /usr/local/lua/dev_sta/nbr_cwmp.lua, resulting in high confidentiality, integrity and availability impact. Publicly available exploit code exists (posted exploit references and a vendor-adjacent GitHub write-up), and EPSS rates the issue at 2.76% (86th percentile), but there is no CISA KEV confirmation of active exploitation. Our assessment classifies this as a credible, elevated-priority issue requiring remediation, but not a top-tier emergency, since the attacker must first reach the management plane with valid low-privilege credentials.
Authenticated OS command injection in Ruijie X30-PRO wireless routers and related Ruijie wireless firmware (RG-EAP602, RG-EST350, RG-EW300 PRO, RG-EST310) allows a low-privileged, logged-in user to execute arbitrary system commands by sending a crafted POST request to the pwdmodify handler implemented in /usr/lib/lua/luci/modules/common.lua. The issue is rated CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), and publicly available exploit code exists - including a dedicated GitHub vulnerability report (flegoity) and accompanying proof-of-concept links - while EPSS sits at 2.66% (roughly the 85th percentile), indicating elevated relative likelihood rather than confirmed active exploitation. Risk concentrates on devices whose web management interface is reachable from untrusted networks; LAN-only or firewalled management interfaces substantially reduce exposure.
Authenticated OS command injection in Ruijie RG-EW1800GX firmware build B11P226_EW1800GX_10223121 (and, per CPE data, the RG-EST350 build 3.0(1)B11P221) lets remote attackers who already hold a low-privilege session execute arbitrary shell commands on the device by sending a crafted POST request to the module_set endpoint handled by /usr/local/lua/dev_sta/nbr_cwmp.lua, resulting in high confidentiality, integrity and availability impact. Publicly available exploit code exists (posted exploit references and a vendor-adjacent GitHub write-up), and EPSS rates the issue at 2.76% (86th percentile), but there is no CISA KEV confirmation of active exploitation. Our assessment classifies this as a credible, elevated-priority issue requiring remediation, but not a top-tier emergency, since the attacker must first reach the management plane with valid low-privilege credentials.