Rg Rap2200 E Firmware
Monthly
Authenticated remote attackers with low privileges can execute arbitrary OS commands on Ruijie RG-RAP2200(E) wireless access points running firmware 3.0(1)B11P247 or Reyee OS 2.280.0 by sending a crafted POST request to the module_set handler in /usr/local/lua/dev_sta/nbr_cwmp.lua (CWE-78, CVSS 8.8). Publicly available exploit code exists, including a proof-of-concept write-up on GitHub and mirrored artifacts, though the flaw is not confirmed actively exploited (not in CISA KEV). EPSS sits at 2.84% (86th percentile), indicating elevated but not top-tier near-term exploitation likelihood; the primary exposure limiter is that exploitation requires network reachability to the management/web interface plus valid low-privilege credentials.
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW_3.0(1)B11P204, RG-NBS and RG-S1930 series switches SWITCH_3.0(1)B11P218, RG-EG series. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Authenticated remote attackers with low privileges can execute arbitrary OS commands on Ruijie RG-RAP2200(E) wireless access points running firmware 3.0(1)B11P247 or Reyee OS 2.280.0 by sending a crafted POST request to the module_set handler in /usr/local/lua/dev_sta/nbr_cwmp.lua (CWE-78, CVSS 8.8). Publicly available exploit code exists, including a proof-of-concept write-up on GitHub and mirrored artifacts, though the flaw is not confirmed actively exploited (not in CISA KEV). EPSS sits at 2.84% (86th percentile), indicating elevated but not top-tier near-term exploitation likelihood; the primary exposure limiter is that exploitation requires network reachability to the management/web interface plus valid low-privilege credentials.
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW_3.0(1)B11P204, RG-NBS and RG-S1930 series switches SWITCH_3.0(1)B11P218, RG-EG series. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.