Rg Ew1200G Pro Firmware
Monthly
OS command injection in Ruijie RG-EW1200G PRO router firmware (V1.00/V2.00/V3.00/V4.00, with the related RG-EW1300G also listed via CPE) lets an authenticated, low-privilege user send a crafted POST request to the module_get handler that reaches /usr/local/lua/dev_sta/networkConnect.lua, where a parameter is passed unsanitized into a shell command - resulting in arbitrary command execution as the device's web/Lua process. Successful exploitation yields full loss of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV). EPSS is 2.64% (85th percentile), indicating elevated but not top-tier likelihood of exploitation; the practical barrier is that the attacker needs at least low-privilege credentials and network reachability to the management interface, so devices with LAN-only, non-default-credentialed admin access are substantially less exposed.
Authenticated OS command injection in Ruijie RG-EW1200G PRO routers running firmware V1.00, V2.00, V3.00 or V4.00 lets a remote attacker with low-privilege credentials execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set action handled in /usr/local/lua/dev_sta/nbr_cwmp.lua. Publicly available exploit code exists (a GitHub vulnerability report plus linked OneDrive proof-of-concept artifacts), and EPSS rates the flaw at 2.76% (86th percentile), but it is not listed in CISA KEV, so active exploitation is not confirmed. Because the CVSS vector is AV:N/PR:L/UI:N with high C/I/A impact, the attacker must first reach the router's management interface and hold valid (even low-level) credentials, meaning LAN-restricted management and strong unique credentials materially reduce exposure.
Authenticated OS command injection in Ruijie RG-EW1200G PRO wireless routers (firmware V1.00, V2.00, V3.00 and V4.00) allows a low-privileged user of the device management interface to execute arbitrary operating-system commands through a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua, yielding high confidentiality, integrity and availability impact (CVSS 8.8). Per the assessed vector (AV:N/AC:L/PR:L/UI:N), the attacker must first reach the management interface and hold at least low-level authenticated access, which is the primary limiting factor; no user interaction is required and attack complexity is low. Publicly available exploit code exists (a dedicated GitHub proof-of-concept write-up plus mirrored exploit artifacts), and EPSS is 2.91% (87th percentile), indicating elevated but not top-tier predicted exploitation likelihood; there is no CISA KEV entry confirming active exploitation, and no vendor-released patch has been identified at time of analysis.
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
RG-EW1200G PRO Wireless Routers EW_3.0(1)B11P204, RG-EW1800GX PRO Wireless Routers EW_3.0(1)B11P204, and RG-EW3200GX PRO Wireless Routers EW_3.0(1)B11P204 were discovered to contain multiple command. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Ruijie Networks RG-EW1200 Wireless Routers EW_3.0(1)B11P204 was discovered to contain a command injetion vulnerability via the params.path parameter in the upgradeConfirm function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OS command injection in Ruijie RG-EW1200G PRO router firmware (V1.00/V2.00/V3.00/V4.00, with the related RG-EW1300G also listed via CPE) lets an authenticated, low-privilege user send a crafted POST request to the module_get handler that reaches /usr/local/lua/dev_sta/networkConnect.lua, where a parameter is passed unsanitized into a shell command - resulting in arbitrary command execution as the device's web/Lua process. Successful exploitation yields full loss of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV). EPSS is 2.64% (85th percentile), indicating elevated but not top-tier likelihood of exploitation; the practical barrier is that the attacker needs at least low-privilege credentials and network reachability to the management interface, so devices with LAN-only, non-default-credentialed admin access are substantially less exposed.
Authenticated OS command injection in Ruijie RG-EW1200G PRO routers running firmware V1.00, V2.00, V3.00 or V4.00 lets a remote attacker with low-privilege credentials execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set action handled in /usr/local/lua/dev_sta/nbr_cwmp.lua. Publicly available exploit code exists (a GitHub vulnerability report plus linked OneDrive proof-of-concept artifacts), and EPSS rates the flaw at 2.76% (86th percentile), but it is not listed in CISA KEV, so active exploitation is not confirmed. Because the CVSS vector is AV:N/PR:L/UI:N with high C/I/A impact, the attacker must first reach the router's management interface and hold valid (even low-level) credentials, meaning LAN-restricted management and strong unique credentials materially reduce exposure.
Authenticated OS command injection in Ruijie RG-EW1200G PRO wireless routers (firmware V1.00, V2.00, V3.00 and V4.00) allows a low-privileged user of the device management interface to execute arbitrary operating-system commands through a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua, yielding high confidentiality, integrity and availability impact (CVSS 8.8). Per the assessed vector (AV:N/AC:L/PR:L/UI:N), the attacker must first reach the management interface and hold at least low-level authenticated access, which is the primary limiting factor; no user interaction is required and attack complexity is low. Publicly available exploit code exists (a dedicated GitHub proof-of-concept write-up plus mirrored exploit artifacts), and EPSS is 2.91% (87th percentile), indicating elevated but not top-tier predicted exploitation likelihood; there is no CISA KEV entry confirming active exploitation, and no vendor-released patch has been identified at time of analysis.
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
RG-EW1200G PRO Wireless Routers EW_3.0(1)B11P204, RG-EW1800GX PRO Wireless Routers EW_3.0(1)B11P204, and RG-EW3200GX PRO Wireless Routers EW_3.0(1)B11P204 were discovered to contain multiple command. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Ruijie Networks RG-EW1200 Wireless Routers EW_3.0(1)B11P204 was discovered to contain a command injetion vulnerability via the params.path parameter in the upgradeConfirm function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.