Rg S1930 Firmware
Monthly
OS command injection in Ruijie RG-S1930 switch firmware 3.0(1)B11P230 (and the related RG-NBS5100-24GT4SFP firmware 3.0(1)B11P248) allows an authenticated low-privilege attacker to execute arbitrary operating-system commands through a crafted POST request to the module_update handler in /usr/local/lua/dev_config/ace_sw.lua. Successful exploitation yields full compromise of the device's confidentiality, integrity, and availability, and publicly available exploit code exists (EPSS 2.07%, 81st percentile), making this an actionable priority for any organization with these switches exposed on a reachable management plane.
OS command injection in Ruijie RG-S1930 switch firmware 3.0(1)B11P230 (and the related RG-NBS5100-24GT4SFP firmware 3.0(1)B11P248) allows an authenticated low-privilege attacker to execute arbitrary operating-system commands through a crafted POST request to the module_update handler in /usr/local/lua/dev_config/ace_sw.lua. Successful exploitation yields full compromise of the device's confidentiality, integrity, and availability, and publicly available exploit code exists (EPSS 2.07%, 81st percentile), making this an actionable priority for any organization with these switches exposed on a reachable management plane.