Rg Nbs5100 24Gt4Sfp Firmware
Monthly
OS command injection in Ruijie RG-S1930 switch firmware 3.0(1)B11P230 (and the related RG-NBS5100-24GT4SFP firmware 3.0(1)B11P248) allows an authenticated low-privilege attacker to execute arbitrary operating-system commands through a crafted POST request to the module_update handler in /usr/local/lua/dev_config/ace_sw.lua. Successful exploitation yields full compromise of the device's confidentiality, integrity, and availability, and publicly available exploit code exists (EPSS 2.07%, 81st percentile), making this an actionable priority for any organization with these switches exposed on a reachable management plane.
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OS command injection in Ruijie RG-S1930 switch firmware 3.0(1)B11P230 (and the related RG-NBS5100-24GT4SFP firmware 3.0(1)B11P248) allows an authenticated low-privilege attacker to execute arbitrary operating-system commands through a crafted POST request to the module_update handler in /usr/local/lua/dev_config/ace_sw.lua. Successful exploitation yields full compromise of the device's confidentiality, integrity, and availability, and publicly available exploit code exists (EPSS 2.07%, 81st percentile), making this an actionable priority for any organization with these switches exposed on a reachable management plane.
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.