Rg Yst250F Firmware
Monthly
Authenticated OS command injection in Ruijie Reyee OS firmware for wireless bridges and access points - including the RG-YST250F, RG-EST310 V2, RG-EAP602 and related RG-YST/EST series devices running Reyee OS 219/221 builds - allows a low-privilege user who can reach the LuCI web management interface to execute arbitrary shell commands on the device by sending a crafted POST request that abuses the pwdmodify function in /usr/lib/lua/luci/modules/common.lua. Because the injected command runs with the privileges of the web server backend (typically root on these embedded platforms), a successful attacker gains full control of the device's confidentiality, integrity and availability, consistent with the assessed CVSS:3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no CISA KEV listing confirming active exploitation and EPSS is modest at 1.66% (76th percentile), but a public GitHub advisory repository documents the flaw along with reproduction detail, so the issue should be treated as a credible mid-tier priority rather than a critical fire-drill - most urgent for operators who have left the management interface reachable from untrusted networks or who still permit default or weak administrative credentials.
OS command injection in Ruijie wireless access point firmware based on Reyee OS - including RG-YST250F, RG-EST310 v2 and RG-EAP602 builds - lets an authenticated attacker with low-privilege management credentials execute arbitrary operating-system commands on the device via a crafted POST request to the pwdmodify handler in /usr/lib/lua/luci/modules/common.lua. The flaw rates CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), and EPSS is 1.66% (~76th percentile), indicating meaningful but not top-tier exploitation likelihood; no public exploit code or confirmed actively exploited status (CISA KEV) was identified at time of analysis. Practical risk depends heavily on whether the web management interface is exposed beyond a trusted admin VLAN, since valid credentials are a prerequisite.
Authenticated command injection in Ruijie Reyee OS (and the affected RG-EW1800GX PRO, RG-EAP602, RG-EST310 V2 and RG-YST250F firmware builds) lets a low-privileged user who can reach the device's HTTP management interface execute arbitrary OS commands by sending a crafted POST request to the module_set handler backed by /usr/local/lua/dev_sta/nbr_cwmp.lua. Because the vulnerable path is part of the CWMP/TR-069 remote-management module, exposure is concentrated in devices with that service enabled; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C/I/A:H) scores 8.8, reflecting full compromise of confidentiality, integrity and availability once valid credentials are supplied. Exploitation requires network reachability and valid low-privilege authentication rather than being unauthenticated, and reports point to a public technical write-up of the flaw; EPSS is 2.05% (81st percentile), indicating moderate but not top-tier predicted exploitation activity, and no public exploit code has been identified at time of analysis.
OS command injection in Ruijie X30-PRO (firmware X30-PRO-V1_09241521) and related Reyee OS-based Ruijie devices allows an authenticated low-privilege user to execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set parameter processed by /usr/local/lua/dev_sta/nbr_networkId_merge.lua. The issue carries a CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and EPSS of 2.00% (80th percentile), indicating a real but currently modest level of exploitation interest; no CISA KEV listing is present and no public exploit code was identified at time of analysis, so this is a serious but not top-tier emergency. The practical barrier is the required authenticated session on the web/management interface, which means unauthenticated internet-wide exploitation is not indicated.
Authenticated OS command injection in Ruijie Reyee OS firmware for wireless bridges and access points - including the RG-YST250F, RG-EST310 V2, RG-EAP602 and related RG-YST/EST series devices running Reyee OS 219/221 builds - allows a low-privilege user who can reach the LuCI web management interface to execute arbitrary shell commands on the device by sending a crafted POST request that abuses the pwdmodify function in /usr/lib/lua/luci/modules/common.lua. Because the injected command runs with the privileges of the web server backend (typically root on these embedded platforms), a successful attacker gains full control of the device's confidentiality, integrity and availability, consistent with the assessed CVSS:3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no CISA KEV listing confirming active exploitation and EPSS is modest at 1.66% (76th percentile), but a public GitHub advisory repository documents the flaw along with reproduction detail, so the issue should be treated as a credible mid-tier priority rather than a critical fire-drill - most urgent for operators who have left the management interface reachable from untrusted networks or who still permit default or weak administrative credentials.
OS command injection in Ruijie wireless access point firmware based on Reyee OS - including RG-YST250F, RG-EST310 v2 and RG-EAP602 builds - lets an authenticated attacker with low-privilege management credentials execute arbitrary operating-system commands on the device via a crafted POST request to the pwdmodify handler in /usr/lib/lua/luci/modules/common.lua. The flaw rates CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), and EPSS is 1.66% (~76th percentile), indicating meaningful but not top-tier exploitation likelihood; no public exploit code or confirmed actively exploited status (CISA KEV) was identified at time of analysis. Practical risk depends heavily on whether the web management interface is exposed beyond a trusted admin VLAN, since valid credentials are a prerequisite.
Authenticated command injection in Ruijie Reyee OS (and the affected RG-EW1800GX PRO, RG-EAP602, RG-EST310 V2 and RG-YST250F firmware builds) lets a low-privileged user who can reach the device's HTTP management interface execute arbitrary OS commands by sending a crafted POST request to the module_set handler backed by /usr/local/lua/dev_sta/nbr_cwmp.lua. Because the vulnerable path is part of the CWMP/TR-069 remote-management module, exposure is concentrated in devices with that service enabled; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C/I/A:H) scores 8.8, reflecting full compromise of confidentiality, integrity and availability once valid credentials are supplied. Exploitation requires network reachability and valid low-privilege authentication rather than being unauthenticated, and reports point to a public technical write-up of the flaw; EPSS is 2.05% (81st percentile), indicating moderate but not top-tier predicted exploitation activity, and no public exploit code has been identified at time of analysis.
OS command injection in Ruijie X30-PRO (firmware X30-PRO-V1_09241521) and related Reyee OS-based Ruijie devices allows an authenticated low-privilege user to execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set parameter processed by /usr/local/lua/dev_sta/nbr_networkId_merge.lua. The issue carries a CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and EPSS of 2.00% (80th percentile), indicating a real but currently modest level of exploitation interest; no CISA KEV listing is present and no public exploit code was identified at time of analysis, so this is a serious but not top-tier emergency. The practical barrier is the required authenticated session on the web/management interface, which means unauthenticated internet-wide exploitation is not indicated.