Rg Ew1300G Firmware
Monthly
OS command injection in Ruijie RG-EW1200G PRO router firmware (V1.00/V2.00/V3.00/V4.00, with the related RG-EW1300G also listed via CPE) lets an authenticated, low-privilege user send a crafted POST request to the module_get handler that reaches /usr/local/lua/dev_sta/networkConnect.lua, where a parameter is passed unsanitized into a shell command - resulting in arbitrary command execution as the device's web/Lua process. Successful exploitation yields full loss of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV). EPSS is 2.64% (85th percentile), indicating elevated but not top-tier likelihood of exploitation; the practical barrier is that the attacker needs at least low-privilege credentials and network reachability to the management interface, so devices with LAN-only, non-default-credentialed admin access are substantially less exposed.
OS command injection in Ruijie M18 EW and RG-EW1300G router firmware allows a remote attacker holding a valid low-privilege management session (CVSS PR:L) to run arbitrary OS commands as the device through a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua. The assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) and the independent assessment agree that exploitation is conditional rather than fully unauthenticated: the attacker must first reach the web/management interface and obtain credentials or a session, with exposure highest where remote administration is enabled. Publicly available exploit code exists (a GitHub proof-of-concept/advisory repository), but there is no CISA KEV listing confirming active exploitation, and EPSS is 2.57% (85th percentile), indicating a credible but conditional priority.
OS command injection in the Ruijie RG-EW1300G router firmware (V1.00, V2.00, and V4.00) allows an attacker who holds valid low-privileged credentials on the web management interface to run arbitrary shell commands on the device by sending a crafted POST request that reaches the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua. Exploitation requires network reachability of the management interface plus valid credentials (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N), and publicly available exploit code exists, though the issue is not listed as confirmed actively exploited (CISA KEV). EPSS sits at 2.84% (86th percentile), so the vulnerability warrants prioritized patching but is not an emergency-level, mass-exploitation event.
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OS command injection in Ruijie RG-EW1200G PRO router firmware (V1.00/V2.00/V3.00/V4.00, with the related RG-EW1300G also listed via CPE) lets an authenticated, low-privilege user send a crafted POST request to the module_get handler that reaches /usr/local/lua/dev_sta/networkConnect.lua, where a parameter is passed unsanitized into a shell command - resulting in arbitrary command execution as the device's web/Lua process. Successful exploitation yields full loss of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV). EPSS is 2.64% (85th percentile), indicating elevated but not top-tier likelihood of exploitation; the practical barrier is that the attacker needs at least low-privilege credentials and network reachability to the management interface, so devices with LAN-only, non-default-credentialed admin access are substantially less exposed.
OS command injection in Ruijie M18 EW and RG-EW1300G router firmware allows a remote attacker holding a valid low-privilege management session (CVSS PR:L) to run arbitrary OS commands as the device through a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua. The assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) and the independent assessment agree that exploitation is conditional rather than fully unauthenticated: the attacker must first reach the web/management interface and obtain credentials or a session, with exposure highest where remote administration is enabled. Publicly available exploit code exists (a GitHub proof-of-concept/advisory repository), but there is no CISA KEV listing confirming active exploitation, and EPSS is 2.57% (85th percentile), indicating a credible but conditional priority.
OS command injection in the Ruijie RG-EW1300G router firmware (V1.00, V2.00, and V4.00) allows an attacker who holds valid low-privileged credentials on the web management interface to run arbitrary shell commands on the device by sending a crafted POST request that reaches the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua. Exploitation requires network reachability of the management interface plus valid credentials (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N), and publicly available exploit code exists, though the issue is not listed as confirmed actively exploited (CISA KEV). EPSS sits at 2.84% (86th percentile), so the vulnerability warrants prioritized patching but is not an emergency-level, mass-exploitation event.
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.