Rg Ew1800Gx Pro Firmware
Monthly
OS command injection in Ruijie RG-EW1800GX PRO (and related RG-EW1800GX / RG-EW300N) router firmware lets an attacker who already holds valid low-privilege credentials execute arbitrary OS commands on the device by sending a crafted POST request to the module_get handler backed by /usr/local/lua/dev_sta/networkConnect.lua. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, exploitation is remote but gated on authenticated access - on these consumer/SOHO routers the management panel is normally LAN-only, so WAN exploitation depends on remote administration being enabled or the panel being internet-exposed. Publicly available exploit code exists (a GitHub PoC writeup plus OneDrive payload links), and EPSS sits at ~2.64% (85th percentile), indicating elevated but not top-tier predicted exploitation; it is not a confirmed actively exploited (CISA KEV) issue.
Authenticated OS command injection in Ruijie RG-EW1800GX PRO (firmware 3.0(1)B11P226) and RG-EW300N (firmware 3.0(1)B11P300) routers allows an attacker holding a valid low-privilege management session to execute arbitrary shell commands on the device by sending a crafted POST request to the module_set handler. Because the injected commands run with the privileges of the router's web/config service, a successful exploit yields full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), enabling configuration tampering, credential theft, traffic interception, and potential use of the device as a pivot into the LAN. Publicly available exploit code exists (including a detailed write-up and proof-of-concept hosted on OneDrive and GitHub), and EPSS sits at 2.57% (85th percentile), so exploitation is feasible for anyone who can authenticate to the management interface, though reachability of that interface (typically LAN-facing unless remote administration is enabled) and the requirement for valid credentials remain the main gates.
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
RG-EW1200G PRO Wireless Routers EW_3.0(1)B11P204, RG-EW1800GX PRO Wireless Routers EW_3.0(1)B11P204, and RG-EW3200GX PRO Wireless Routers EW_3.0(1)B11P204 were discovered to contain multiple command. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OS command injection in Ruijie RG-EW1800GX PRO (and related RG-EW1800GX / RG-EW300N) router firmware lets an attacker who already holds valid low-privilege credentials execute arbitrary OS commands on the device by sending a crafted POST request to the module_get handler backed by /usr/local/lua/dev_sta/networkConnect.lua. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, exploitation is remote but gated on authenticated access - on these consumer/SOHO routers the management panel is normally LAN-only, so WAN exploitation depends on remote administration being enabled or the panel being internet-exposed. Publicly available exploit code exists (a GitHub PoC writeup plus OneDrive payload links), and EPSS sits at ~2.64% (85th percentile), indicating elevated but not top-tier predicted exploitation; it is not a confirmed actively exploited (CISA KEV) issue.
Authenticated OS command injection in Ruijie RG-EW1800GX PRO (firmware 3.0(1)B11P226) and RG-EW300N (firmware 3.0(1)B11P300) routers allows an attacker holding a valid low-privilege management session to execute arbitrary shell commands on the device by sending a crafted POST request to the module_set handler. Because the injected commands run with the privileges of the router's web/config service, a successful exploit yields full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), enabling configuration tampering, credential theft, traffic interception, and potential use of the device as a pivot into the LAN. Publicly available exploit code exists (including a detailed write-up and proof-of-concept hosted on OneDrive and GitHub), and EPSS sits at 2.57% (85th percentile), so exploitation is feasible for anyone who can authenticate to the management interface, though reachability of that interface (typically LAN-facing unless remote administration is enabled) and the requirement for valid credentials remain the main gates.
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
RG-EW1200G PRO Wireless Routers EW_3.0(1)B11P204, RG-EW1800GX PRO Wireless Routers EW_3.0(1)B11P204, and RG-EW3200GX PRO Wireless Routers EW_3.0(1)B11P204 were discovered to contain multiple command. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.