Rg Ew300R Firmware
Monthly
Authenticated OS command injection in Ruijie RG-EW1800GX (firmware B11P226) and RG-EW300R (firmware B11P301) routers lets an attacker who already holds credentials on the device execute arbitrary shell commands by sending a crafted POST request to the module_get action handled by /usr/local/lua/dev_sta/networkConnect.lua. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) confirms network reachability and low attack complexity but requires some form of authentication (PR:L), which is the main practical barrier; publicly available exploit code exists (no CISA KEV listing, so active exploitation is not confirmed), and EPSS sits at 2.57% (85th percentile), indicating a modest but above-average likelihood of exploitation relative to the wider CVE population. Devices with a WAN-exposed management interface, remote management enabled, or weak/default admin credentials are materially more exposed than LAN-only, strongly-authenticated deployments.
OS command injection in the Ruijie RG-EW1800GX and RG-EW300R router firmware allows an authenticated attacker to execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set handler backed by /usr/local/lua/dev_config/config_retain.lua. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N), exploitation is remote, low-complexity, and requires only low-privilege authentication, so the primary barrier is obtaining valid low-level credentials or abusing weak/default logins; no user interaction is needed. Publicly available exploit code exists and the vulnerability is detailed in a public GitHub advisory, but there is no confirmation that it is being actively exploited (not listed on CISA KEV); EPSS is 2.91% (87th percentile), indicating elevated relative likelihood of exploitation activity. The risk profile is a credible, actionable priority but not a drop-everything emergency.
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW_3.0(1)B11P204, RG-NBS and RG-S1930 series switches SWITCH_3.0(1)B11P218, RG-EG series. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Authenticated OS command injection in Ruijie RG-EW1800GX (firmware B11P226) and RG-EW300R (firmware B11P301) routers lets an attacker who already holds credentials on the device execute arbitrary shell commands by sending a crafted POST request to the module_get action handled by /usr/local/lua/dev_sta/networkConnect.lua. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) confirms network reachability and low attack complexity but requires some form of authentication (PR:L), which is the main practical barrier; publicly available exploit code exists (no CISA KEV listing, so active exploitation is not confirmed), and EPSS sits at 2.57% (85th percentile), indicating a modest but above-average likelihood of exploitation relative to the wider CVE population. Devices with a WAN-exposed management interface, remote management enabled, or weak/default admin credentials are materially more exposed than LAN-only, strongly-authenticated deployments.
OS command injection in the Ruijie RG-EW1800GX and RG-EW300R router firmware allows an authenticated attacker to execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set handler backed by /usr/local/lua/dev_config/config_retain.lua. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N), exploitation is remote, low-complexity, and requires only low-privilege authentication, so the primary barrier is obtaining valid low-level credentials or abusing weak/default logins; no user interaction is needed. Publicly available exploit code exists and the vulnerability is detailed in a public GitHub advisory, but there is no confirmation that it is being actively exploited (not listed on CISA KEV); EPSS is 2.91% (87th percentile), indicating elevated relative likelihood of exploitation activity. The risk profile is a credible, actionable priority but not a drop-everything emergency.
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW_3.0(1)B11P204, RG-NBS and RG-S1930 series switches SWITCH_3.0(1)B11P218, RG-EG series. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.