Rg Ew300G Pro Firmware
Monthly
Authenticated OS command injection in Ruijie M18 EW_3.0(1)B11P226 firmware (with the same code path in RG-EW300G Pro EW_3.0(1)B11P219) lets a low-privileged authenticated attacker execute arbitrary shell commands on the device by sending a crafted POST request to the module_set function in /usr/local/lua/dev_sta/nbr_cwmp.lua. Exploitation requires network reachability to the device management interface plus valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N, score 8.8), and no user interaction is needed. Publicly available exploit code exists and the EPSS score is 2.84% (86th percentile), so risk is real but this is a credible, not top-tier emergency, priority - exposure drops sharply for devices whose management UI is not reachable from untrusted networks.
Authenticated OS command injection in Ruijie M18 EW_3.0(1)B11P226 firmware (with the same code path in RG-EW300G Pro EW_3.0(1)B11P219) lets a low-privileged authenticated attacker execute arbitrary shell commands on the device by sending a crafted POST request to the module_set function in /usr/local/lua/dev_sta/nbr_cwmp.lua. Exploitation requires network reachability to the device management interface plus valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N, score 8.8), and no user interaction is needed. Publicly available exploit code exists and the EPSS score is 2.84% (86th percentile), so risk is real but this is a credible, not top-tier emergency, priority - exposure drops sharply for devices whose management UI is not reachable from untrusted networks.