Rg Ew1200 Firmware
Monthly
Authenticated command execution in Ruijie X60 PRO router firmware (RG-X60 PRO V1.00/V2.00, build 1.021.2014, with RG-EW1200 firmware also listed via CPE) allows an attacker who can reach the device's web/m anagement backend to run arbitrary OS commands on the router by submitting a crafted POST request to the module_get routine in /usr/local/lua/dev_sta/networkConnect.lua. The flaw is a CWE-78 OS command injection; the assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates low-privilege credentials on the management interface are required, but no user interaction is needed and successful exploitation yields full compromise of confidentiality, integrity, and availability on the device. Publicly available exploit code exists (a detailed GitHub write-up for CVE-2025-56124), and EPSS sits at 1.30% (70th percentile), so exploitation is plausible for attackers with management-plane access even though no confirmed in-the-wild activity is reported. No vendor-released patch was identified at time of analysis.
OS command injection in Ruijie X60 PRO firmware (V1.00/V2.00, build X60_10212014RG) lets an authenticated remote attacker who can reach the device's HTTP management interface execute arbitrary operating-system commands by sending a crafted POST request to the module_set operation handled by /usr/local/lua/dev_config/config_retain.lua. The vulnerability requires valid credentials (CVSS PR:L, network reachable, no user interaction), so practical exposure is concentrated on devices whose admin interface is exposed to untrusted networks or left on weak/default logins. Publicly available exploit code exists and EPSS sits at roughly 2.64% (85th percentile), indicating moderately elevated but not uniformly high exploitation risk; no CISA KEV confirmation of active exploitation was present in the available data.
Authenticated OS command injection in Ruijie RG-EW1200 (firmware 3.0(1)B11P227) and RG-X60 (firmware 3.0(1)B11P237) routers lets a network-reachable attacker who already holds low-privilege credentials run arbitrary commands on the device by sending a crafted POST request to the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua. Publicly available exploit code exists and the EPSS score is 2.91% (87th percentile), but there is no confirmed active exploitation (the CVE is not in CISA KEV). Impact per the assessed vector is high - full loss of confidentiality, integrity, and availability on the affected device - yet exploitation first requires valid credentials or a session, so this is a credible mid-tier priority rather than an emergency.
Command injection in Ruijie RG-EW1200 and RG-EW300 Pro router firmware lets authenticated network attackers execute arbitrary operating system commands through a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua. The vulnerable builds are RG-EW1200 firmware 3.0(1)B11P227 and RG-EW300 Pro firmware 3.0(1)B11P219, and exploitation requires network reachability to the web/management interface plus low-privilege credentials (CVSS PR:L). Publicly available exploit code exists, and EPSS is 2.92% (87th percentile), but there is no CISA KEV entry confirming active exploitation; the independent assessment rates this as elevated-priority for affected SOHO router operators rather than an internet-wide emergency.
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW_3.0(1)B11P204, RG-NBS and RG-S1930 series switches SWITCH_3.0(1)B11P218, RG-EG series. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Ruijie Networks RG-EW1200 Wireless Routers EW_3.0(1)B11P204 was discovered to contain a command injetion vulnerability via the params.path parameter in the upgradeConfirm function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated command execution in Ruijie X60 PRO router firmware (RG-X60 PRO V1.00/V2.00, build 1.021.2014, with RG-EW1200 firmware also listed via CPE) allows an attacker who can reach the device's web/m anagement backend to run arbitrary OS commands on the router by submitting a crafted POST request to the module_get routine in /usr/local/lua/dev_sta/networkConnect.lua. The flaw is a CWE-78 OS command injection; the assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates low-privilege credentials on the management interface are required, but no user interaction is needed and successful exploitation yields full compromise of confidentiality, integrity, and availability on the device. Publicly available exploit code exists (a detailed GitHub write-up for CVE-2025-56124), and EPSS sits at 1.30% (70th percentile), so exploitation is plausible for attackers with management-plane access even though no confirmed in-the-wild activity is reported. No vendor-released patch was identified at time of analysis.
OS command injection in Ruijie X60 PRO firmware (V1.00/V2.00, build X60_10212014RG) lets an authenticated remote attacker who can reach the device's HTTP management interface execute arbitrary operating-system commands by sending a crafted POST request to the module_set operation handled by /usr/local/lua/dev_config/config_retain.lua. The vulnerability requires valid credentials (CVSS PR:L, network reachable, no user interaction), so practical exposure is concentrated on devices whose admin interface is exposed to untrusted networks or left on weak/default logins. Publicly available exploit code exists and EPSS sits at roughly 2.64% (85th percentile), indicating moderately elevated but not uniformly high exploitation risk; no CISA KEV confirmation of active exploitation was present in the available data.
Authenticated OS command injection in Ruijie RG-EW1200 (firmware 3.0(1)B11P227) and RG-X60 (firmware 3.0(1)B11P237) routers lets a network-reachable attacker who already holds low-privilege credentials run arbitrary commands on the device by sending a crafted POST request to the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua. Publicly available exploit code exists and the EPSS score is 2.91% (87th percentile), but there is no confirmed active exploitation (the CVE is not in CISA KEV). Impact per the assessed vector is high - full loss of confidentiality, integrity, and availability on the affected device - yet exploitation first requires valid credentials or a session, so this is a credible mid-tier priority rather than an emergency.
Command injection in Ruijie RG-EW1200 and RG-EW300 Pro router firmware lets authenticated network attackers execute arbitrary operating system commands through a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua. The vulnerable builds are RG-EW1200 firmware 3.0(1)B11P227 and RG-EW300 Pro firmware 3.0(1)B11P219, and exploitation requires network reachability to the web/management interface plus low-privilege credentials (CVSS PR:L). Publicly available exploit code exists, and EPSS is 2.92% (87th percentile), but there is no CISA KEV entry confirming active exploitation; the independent assessment rates this as elevated-priority for affected SOHO router operators rather than an internet-wide emergency.
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW_3.0(1)B11P204, RG-NBS and RG-S1930 series switches SWITCH_3.0(1)B11P218, RG-EG series. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Ruijie Networks RG-EW1200 Wireless Routers EW_3.0(1)B11P204 was discovered to contain a command injetion vulnerability via the params.path parameter in the upgradeConfirm function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.