Rg Ew1800Gx Firmware
Monthly
OS command injection in Ruijie RG-EW1800GX PRO (and related RG-EW1800GX / RG-EW300N) router firmware lets an attacker who already holds valid low-privilege credentials execute arbitrary OS commands on the device by sending a crafted POST request to the module_get handler backed by /usr/local/lua/dev_sta/networkConnect.lua. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, exploitation is remote but gated on authenticated access - on these consumer/SOHO routers the management panel is normally LAN-only, so WAN exploitation depends on remote administration being enabled or the panel being internet-exposed. Publicly available exploit code exists (a GitHub PoC writeup plus OneDrive payload links), and EPSS sits at ~2.64% (85th percentile), indicating elevated but not top-tier predicted exploitation; it is not a confirmed actively exploited (CISA KEV) issue.
Authenticated OS command injection in Ruijie RG-EW1800GX firmware build B11P226_EW1800GX_10223121 (and, per CPE data, the RG-EST350 build 3.0(1)B11P221) lets remote attackers who already hold a low-privilege session execute arbitrary shell commands on the device by sending a crafted POST request to the module_set endpoint handled by /usr/local/lua/dev_sta/nbr_cwmp.lua, resulting in high confidentiality, integrity and availability impact. Publicly available exploit code exists (posted exploit references and a vendor-adjacent GitHub write-up), and EPSS rates the issue at 2.76% (86th percentile), but there is no CISA KEV confirmation of active exploitation. Our assessment classifies this as a credible, elevated-priority issue requiring remediation, but not a top-tier emergency, since the attacker must first reach the management plane with valid low-privilege credentials.
Authenticated OS command injection in Ruijie RG-EW1800GX (firmware B11P226) and RG-EW300R (firmware B11P301) routers lets an attacker who already holds credentials on the device execute arbitrary shell commands by sending a crafted POST request to the module_get action handled by /usr/local/lua/dev_sta/networkConnect.lua. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) confirms network reachability and low attack complexity but requires some form of authentication (PR:L), which is the main practical barrier; publicly available exploit code exists (no CISA KEV listing, so active exploitation is not confirmed), and EPSS sits at 2.57% (85th percentile), indicating a modest but above-average likelihood of exploitation relative to the wider CVE population. Devices with a WAN-exposed management interface, remote management enabled, or weak/default admin credentials are materially more exposed than LAN-only, strongly-authenticated deployments.
OS command injection in the Ruijie RG-EW1800GX and RG-EW300R router firmware allows an authenticated attacker to execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set handler backed by /usr/local/lua/dev_config/config_retain.lua. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N), exploitation is remote, low-complexity, and requires only low-privilege authentication, so the primary barrier is obtaining valid low-level credentials or abusing weak/default logins; no user interaction is needed. Publicly available exploit code exists and the vulnerability is detailed in a public GitHub advisory, but there is no confirmation that it is being actively exploited (not listed on CISA KEV); EPSS is 2.91% (87th percentile), indicating elevated relative likelihood of exploitation activity. The risk profile is a credible, actionable priority but not a drop-everything emergency.
Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW_3.0(1)B11P204, RG-NBS and RG-S1930 series switches SWITCH_3.0(1)B11P218, RG-EG series. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
OS command injection in Ruijie RG-EW1800GX PRO (and related RG-EW1800GX / RG-EW300N) router firmware lets an attacker who already holds valid low-privilege credentials execute arbitrary OS commands on the device by sending a crafted POST request to the module_get handler backed by /usr/local/lua/dev_sta/networkConnect.lua. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, exploitation is remote but gated on authenticated access - on these consumer/SOHO routers the management panel is normally LAN-only, so WAN exploitation depends on remote administration being enabled or the panel being internet-exposed. Publicly available exploit code exists (a GitHub PoC writeup plus OneDrive payload links), and EPSS sits at ~2.64% (85th percentile), indicating elevated but not top-tier predicted exploitation; it is not a confirmed actively exploited (CISA KEV) issue.
Authenticated OS command injection in Ruijie RG-EW1800GX firmware build B11P226_EW1800GX_10223121 (and, per CPE data, the RG-EST350 build 3.0(1)B11P221) lets remote attackers who already hold a low-privilege session execute arbitrary shell commands on the device by sending a crafted POST request to the module_set endpoint handled by /usr/local/lua/dev_sta/nbr_cwmp.lua, resulting in high confidentiality, integrity and availability impact. Publicly available exploit code exists (posted exploit references and a vendor-adjacent GitHub write-up), and EPSS rates the issue at 2.76% (86th percentile), but there is no CISA KEV confirmation of active exploitation. Our assessment classifies this as a credible, elevated-priority issue requiring remediation, but not a top-tier emergency, since the attacker must first reach the management plane with valid low-privilege credentials.
Authenticated OS command injection in Ruijie RG-EW1800GX (firmware B11P226) and RG-EW300R (firmware B11P301) routers lets an attacker who already holds credentials on the device execute arbitrary shell commands by sending a crafted POST request to the module_get action handled by /usr/local/lua/dev_sta/networkConnect.lua. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) confirms network reachability and low attack complexity but requires some form of authentication (PR:L), which is the main practical barrier; publicly available exploit code exists (no CISA KEV listing, so active exploitation is not confirmed), and EPSS sits at 2.57% (85th percentile), indicating a modest but above-average likelihood of exploitation relative to the wider CVE population. Devices with a WAN-exposed management interface, remote management enabled, or weak/default admin credentials are materially more exposed than LAN-only, strongly-authenticated deployments.
OS command injection in the Ruijie RG-EW1800GX and RG-EW300R router firmware allows an authenticated attacker to execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set handler backed by /usr/local/lua/dev_config/config_retain.lua. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N), exploitation is remote, low-complexity, and requires only low-privilege authentication, so the primary barrier is obtaining valid low-level credentials or abusing weak/default logins; no user interaction is needed. Publicly available exploit code exists and the vulnerability is detailed in a public GitHub advisory, but there is no confirmation that it is being actively exploited (not listed on CISA KEV); EPSS is 2.91% (87th percentile), indicating elevated relative likelihood of exploitation activity. The risk profile is a credible, actionable priority but not a drop-everything emergency.
Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW_3.0(1)B11P204, RG-NBS and RG-S1930 series switches SWITCH_3.0(1)B11P218, RG-EG series. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.