Rg Ew300N Firmware
Monthly
OS command injection in Ruijie RG-EW1800GX PRO (and related RG-EW1800GX / RG-EW300N) router firmware lets an attacker who already holds valid low-privilege credentials execute arbitrary OS commands on the device by sending a crafted POST request to the module_get handler backed by /usr/local/lua/dev_sta/networkConnect.lua. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, exploitation is remote but gated on authenticated access - on these consumer/SOHO routers the management panel is normally LAN-only, so WAN exploitation depends on remote administration being enabled or the panel being internet-exposed. Publicly available exploit code exists (a GitHub PoC writeup plus OneDrive payload links), and EPSS sits at ~2.64% (85th percentile), indicating elevated but not top-tier predicted exploitation; it is not a confirmed actively exploited (CISA KEV) issue.
Authenticated OS command injection in Ruijie RG-EW1800GX PRO (firmware 3.0(1)B11P226) and RG-EW300N (firmware 3.0(1)B11P300) routers allows an attacker holding a valid low-privilege management session to execute arbitrary shell commands on the device by sending a crafted POST request to the module_set handler. Because the injected commands run with the privileges of the router's web/config service, a successful exploit yields full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), enabling configuration tampering, credential theft, traffic interception, and potential use of the device as a pivot into the LAN. Publicly available exploit code exists (including a detailed write-up and proof-of-concept hosted on OneDrive and GitHub), and EPSS sits at 2.57% (85th percentile), so exploitation is feasible for anyone who can authenticate to the management interface, though reachability of that interface (typically LAN-facing unless remote administration is enabled) and the requirement for valid credentials remain the main gates.
OS command injection in Ruijie RG-EW1800GX PRO (and related RG-EW1800GX / RG-EW300N) router firmware lets an attacker who already holds valid low-privilege credentials execute arbitrary OS commands on the device by sending a crafted POST request to the module_get handler backed by /usr/local/lua/dev_sta/networkConnect.lua. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, exploitation is remote but gated on authenticated access - on these consumer/SOHO routers the management panel is normally LAN-only, so WAN exploitation depends on remote administration being enabled or the panel being internet-exposed. Publicly available exploit code exists (a GitHub PoC writeup plus OneDrive payload links), and EPSS sits at ~2.64% (85th percentile), indicating elevated but not top-tier predicted exploitation; it is not a confirmed actively exploited (CISA KEV) issue.
Authenticated OS command injection in Ruijie RG-EW1800GX PRO (firmware 3.0(1)B11P226) and RG-EW300N (firmware 3.0(1)B11P300) routers allows an attacker holding a valid low-privilege management session to execute arbitrary shell commands on the device by sending a crafted POST request to the module_set handler. Because the injected commands run with the privileges of the router's web/config service, a successful exploit yields full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), enabling configuration tampering, credential theft, traffic interception, and potential use of the device as a pivot into the LAN. Publicly available exploit code exists (including a detailed write-up and proof-of-concept hosted on OneDrive and GitHub), and EPSS sits at 2.57% (85th percentile), so exploitation is feasible for anyone who can authenticate to the management interface, though reachability of that interface (typically LAN-facing unless remote administration is enabled) and the requirement for valid credentials remain the main gates.