Ruijie
Monthly
A high-privileged authenticated attacker can inject and execute arbitrary operating-system commands on the Ruijie RG-EW3000GX router running firmware EW_3.0(1)B11P380, through the user_list_note functionality that manipulates the Name argument resolved from /etc/rg_config/admin. The vulnerability is network-reachable and requires no user interaction, but the CVSS vector (PR:H) confirms it is only exploitable after obtaining administrator credentials for the device management interface, so anonymous internet attackers cannot reach it directly. Publicly available exploit code exists (a GitHub proof-of-concept for the RG-EW3000GX user_list_note flaw), which materially raises the likelihood of post-authentication abuse, particularly on routers whose management plane is exposed to the WAN or protected by weak/default admin passwords; no CISA KEV entry has been reported for this CVE.
OS command injection in the Ruijie RG-EW3000GX router (firmware EW_3.0(1)B11P380) lets an attacker who already holds a valid administrator session execute arbitrary shell commands on the device by injecting metacharacters into the data.url argument of a configChange request handled by the cc_set function in unifyframe-sgi.elf. Exploitation is remote and low-complexity once admin access is obtained, and publicly available exploit code exists (PoC disclosed via GitHub and VulDB), though there is no CISA KEV confirmation of active exploitation. Because the CVSS vector carries PR:H and the independent assessment confirms the configChange/cc_set path is not reachable pre-authentication, this is a real but privilege-gated vulnerability rather than an unauthenticated takeover.
Command injection in the Ruijie EG105G-P 2.340 gateway router allows authenticated remote attackers to execute arbitrary OS commands by manipulating the params.target argument of the nslookup function in the /cgi-bin/luci/api/diagnose JSON-RPC endpoint. Publicly available exploit code exists, the vendor did not respond to coordinated disclosure, and successful exploitation yields full confidentiality, integrity, and availability impact on the device.
OS command injection in Ruijie Networks' AP180 series indoor wall-plate wireless access points (RG-AP180) lets an attacker who has already authenticated to the device CLI execute arbitrary operating-system commands on the access point. Because CLI login is a hard prerequisite (CVSS 4.0 vector PR:H, and the independent assessment confirms PR:H under CVSS 3.1), this is not a pre-authentication or remote-unauthenticated attack path; exposure depends on whether the CLI is reachable from untrusted networks and whether default, shared, or weak administrative credentials are in use. There is no confirmed active exploitation (CISA KEV is not indicated), no public exploit code identified at time of analysis, and the EPSS score is modest at 1.41% (72nd percentile), so this is a moderate real-world risk rather than an urgent priority.
OS command injection in Ruijie RG-S1930 switch firmware 3.0(1)B11P230 (and the related RG-NBS5100-24GT4SFP firmware 3.0(1)B11P248) allows an authenticated low-privilege attacker to execute arbitrary operating-system commands through a crafted POST request to the module_update handler in /usr/local/lua/dev_config/ace_sw.lua. Successful exploitation yields full compromise of the device's confidentiality, integrity, and availability, and publicly available exploit code exists (EPSS 2.07%, 81st percentile), making this an actionable priority for any organization with these switches exposed on a reachable management plane.
OS command injection in the Ruijie RG-BCR860 wireless router (firmware 2.5.13) lets an authenticated attacker execute arbitrary commands on the underlying operating system by sending a crafted POST request to the action_diagnosis endpoint of the LuCI web management interface. Because the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N, exploitation requires only network reachability to the admin interface and low-privileged credentials - meaning default or weak administrator passwords, or any compromised low-privilege account, materially elevate risk - and needs no user interaction. Publicly available exploit code exists (a public write-up and PoC are linked from the references), and EPSS places the 30-day exploitation probability at 2.64% (85th percentile), which is high relative to the broader CVE population, although there is no confirmed active exploitation (CISA KEV) at time of analysis.
OS command injection in the Ruijie RG-BCR600W router firmware (build 1.0.4.4468) lets an attacker who already holds valid low-privilege credentials execute arbitrary shell commands on the device by sending a crafted POST request to the get_wanobj handler in /usr/lib/lua/luci/controller/admin/common.lua. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N) and carries an EPSS score of roughly 3.14% (88th percentile), and publicly available exploit code exists - though no CISA KEV entry confirms active exploitation. Exploitation is conditional rather than anonymous: the attacker must be able to reach the web management interface and authenticate, so risk rises sharply wherever the admin panel is exposed beyond the LAN or default credentials remain in place.
Authenticated command execution in Ruijie X60 PRO router firmware (RG-X60 PRO V1.00/V2.00, build 1.021.2014, with RG-EW1200 firmware also listed via CPE) allows an attacker who can reach the device's web/m anagement backend to run arbitrary OS commands on the router by submitting a crafted POST request to the module_get routine in /usr/local/lua/dev_sta/networkConnect.lua. The flaw is a CWE-78 OS command injection; the assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates low-privilege credentials on the management interface are required, but no user interaction is needed and successful exploitation yields full compromise of confidentiality, integrity, and availability on the device. Publicly available exploit code exists (a detailed GitHub write-up for CVE-2025-56124), and EPSS sits at 1.30% (70th percentile), so exploitation is plausible for attackers with management-plane access even though no confirmed in-the-wild activity is reported. No vendor-released patch was identified at time of analysis.
OS command injection in Ruijie RG-EW1200G PRO router firmware (V1.00/V2.00/V3.00/V4.00, with the related RG-EW1300G also listed via CPE) lets an authenticated, low-privilege user send a crafted POST request to the module_get handler that reaches /usr/local/lua/dev_sta/networkConnect.lua, where a parameter is passed unsanitized into a shell command - resulting in arbitrary command execution as the device's web/Lua process. Successful exploitation yields full loss of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV). EPSS is 2.64% (85th percentile), indicating elevated but not top-tier likelihood of exploitation; the practical barrier is that the attacker needs at least low-privilege credentials and network reachability to the management interface, so devices with LAN-only, non-default-credentialed admin access are substantially less exposed.
OS command injection in Ruijie RG-EW1800GX PRO (and related RG-EW1800GX / RG-EW300N) router firmware lets an attacker who already holds valid low-privilege credentials execute arbitrary OS commands on the device by sending a crafted POST request to the module_get handler backed by /usr/local/lua/dev_sta/networkConnect.lua. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, exploitation is remote but gated on authenticated access - on these consumer/SOHO routers the management panel is normally LAN-only, so WAN exploitation depends on remote administration being enabled or the panel being internet-exposed. Publicly available exploit code exists (a GitHub PoC writeup plus OneDrive payload links), and EPSS sits at ~2.64% (85th percentile), indicating elevated but not top-tier predicted exploitation; it is not a confirmed actively exploited (CISA KEV) issue.
Authenticated OS command injection in the Ruijie X30-PRO (and RG-EST310) firmware allows a low-privileged user to execute arbitrary commands on the device by sending a single crafted POST request to the 'module_set' operation handled by /usr/local/lua/dev_sta/nbr_cwmp.lua. According to the CVSS vector (AV:N/AC:L/PR:L/UI:N), exploitation is remote, low complexity, and requires only valid low-level credentials against the management service, with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists, and the EPSS score of 3.05% (87th percentile) indicates elevated relative risk, though there is no confirmation of active exploitation.
OS command injection in Ruijie M18 EW and RG-EW1300G router firmware allows a remote attacker holding a valid low-privilege management session (CVSS PR:L) to run arbitrary OS commands as the device through a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua. The assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) and the independent assessment agree that exploitation is conditional rather than fully unauthenticated: the attacker must first reach the web/management interface and obtain credentials or a session, with exposure highest where remote administration is enabled. Publicly available exploit code exists (a GitHub proof-of-concept/advisory repository), but there is no CISA KEV listing confirming active exploitation, and EPSS is 2.57% (85th percentile), indicating a credible but conditional priority.
Authenticated OS command injection in Ruijie Reyee OS firmware for wireless bridges and access points - including the RG-YST250F, RG-EST310 V2, RG-EAP602 and related RG-YST/EST series devices running Reyee OS 219/221 builds - allows a low-privilege user who can reach the LuCI web management interface to execute arbitrary shell commands on the device by sending a crafted POST request that abuses the pwdmodify function in /usr/lib/lua/luci/modules/common.lua. Because the injected command runs with the privileges of the web server backend (typically root on these embedded platforms), a successful attacker gains full control of the device's confidentiality, integrity and availability, consistent with the assessed CVSS:3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no CISA KEV listing confirming active exploitation and EPSS is modest at 1.66% (76th percentile), but a public GitHub advisory repository documents the flaw along with reproduction detail, so the issue should be treated as a credible mid-tier priority rather than a critical fire-drill - most urgent for operators who have left the management interface reachable from untrusted networks or who still permit default or weak administrative credentials.
OS command injection in the Ruijie RG-BCR860 router firmware (build 2.5.13-r2224) lets attackers with a valid low-privilege session on the web management interface execute arbitrary OS commands on the device by sending a crafted POST request to the network_set_wan_conf endpoint. The flaw resides in the LuCI controller file /usr/lib/lua/luci/controller/admin/netport.lua and carries a CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning authentication is required but no user interaction is needed. Publicly available exploit code exists (EPSS 3.05%, percentile 87%), but there is no CISA KEV confirmation of active exploitation at time of analysis; the practical risk is highest where the router's management interface is exposed beyond a trusted LAN segment.
OS command injection in the Ruijie RG-BCR600W router firmware allows an attacker who holds a low-privilege authenticated session on the web management interface to run arbitrary operating-system commands by sending a crafted POST request to the submit_wifi action handled by /usr/lib/lua/luci/controller/admin/common_quick_config.lua. Successful exploitation yields full compromise of confidentiality, integrity, and availability of the device (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the practical risk is highest where the admin panel is reachable from the internet or an untrusted LAN segment and where default or weak credentials remain in place. EPSS sits at roughly 2.25% (83rd percentile), indicating elevated relative attention but not a mass-exploitation event, and no public exploit identified at time of analysis; this is a credible above-average priority for operators of the affected hardware rather than an emergency.
Authenticated OS command injection in Ruijie RG-EW1800GX (firmware B11P226) and RG-EW300R (firmware B11P301) routers lets an attacker who already holds credentials on the device execute arbitrary shell commands by sending a crafted POST request to the module_get action handled by /usr/local/lua/dev_sta/networkConnect.lua. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) confirms network reachability and low attack complexity but requires some form of authentication (PR:L), which is the main practical barrier; publicly available exploit code exists (no CISA KEV listing, so active exploitation is not confirmed), and EPSS sits at 2.57% (85th percentile), indicating a modest but above-average likelihood of exploitation relative to the wider CVE population. Devices with a WAN-exposed management interface, remote management enabled, or weak/default admin credentials are materially more exposed than LAN-only, strongly-authenticated deployments.
OS command injection in Ruijie wireless access point firmware based on Reyee OS - including RG-YST250F, RG-EST310 v2 and RG-EAP602 builds - lets an authenticated attacker with low-privilege management credentials execute arbitrary operating-system commands on the device via a crafted POST request to the pwdmodify handler in /usr/lib/lua/luci/modules/common.lua. The flaw rates CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), and EPSS is 1.66% (~76th percentile), indicating meaningful but not top-tier exploitation likelihood; no public exploit code or confirmed actively exploited status (CISA KEV) was identified at time of analysis. Practical risk depends heavily on whether the web management interface is exposed beyond a trusted admin VLAN, since valid credentials are a prerequisite.
OS command injection in Ruijie X30-PRO (firmware X30-PRO-V1_09241521) and Ruijie RG-EW300 Pro (firmware 3.0(1)b11p219) allows a low-privilege authenticated attacker to execute arbitrary OS commands via a crafted POST request to the module_get function in /usr/local/lua/dev_sta/networkConnect.lua. Publicly available exploit code exists, and the EPSS score is 2.57% (85th percentile), indicating a moderate likelihood of exploitation, though no active exploitation has been confirmed (not listed in CISA KEV). The vulnerability is remotely exploitable with low complexity but requires valid credentials to the device's web management interface.
Authenticated OS command injection in Ruijie RG-EW1800GX PRO (firmware 3.0(1)B11P226) and RG-EW300N (firmware 3.0(1)B11P300) routers allows an attacker holding a valid low-privilege management session to execute arbitrary shell commands on the device by sending a crafted POST request to the module_set handler. Because the injected commands run with the privileges of the router's web/config service, a successful exploit yields full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), enabling configuration tampering, credential theft, traffic interception, and potential use of the device as a pivot into the LAN. Publicly available exploit code exists (including a detailed write-up and proof-of-concept hosted on OneDrive and GitHub), and EPSS sits at 2.57% (85th percentile), so exploitation is feasible for anyone who can authenticate to the management interface, though reachability of that interface (typically LAN-facing unless remote administration is enabled) and the requirement for valid credentials remain the main gates.
Authenticated OS command injection in the Ruijie RG-BCR600W router firmware allows a logged-in, low-privilege user to run arbitrary shell commands on the device by sending a crafted POST request to the restart_modules action implemented in /usr/lib/lua/luci/controller/admin/common.lua. The issue is rated CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and classified CWE-78, with EPSS at 1.98% (~80th percentile) indicating a modest but non-trivial likelihood of exploitation attempts in the wild. Exploitation is not pre-authentication: attackers must first reach the web management interface and hold valid low-privilege credentials, so exposure hinges on whether the device's admin plane is reachable from untrusted networks; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Authenticated OS command injection in Ruijie RG-EW1200G PRO routers running firmware V1.00, V2.00, V3.00 or V4.00 lets a remote attacker with low-privilege credentials execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set action handled in /usr/local/lua/dev_sta/nbr_cwmp.lua. Publicly available exploit code exists (a GitHub vulnerability report plus linked OneDrive proof-of-concept artifacts), and EPSS rates the flaw at 2.76% (86th percentile), but it is not listed in CISA KEV, so active exploitation is not confirmed. Because the CVSS vector is AV:N/PR:L/UI:N with high C/I/A impact, the attacker must first reach the router's management interface and hold valid (even low-level) credentials, meaning LAN-restricted management and strong unique credentials materially reduce exposure.
Authenticated command injection in Ruijie X30-PRO and RG-EW300 PRO router firmware allows an attacker with low-privileged credentials to execute arbitrary OS commands via a crafted POST request to the module_get function in /usr/local/lua/dev_sta/host_access_delay.lua. Publicly available exploit code exists, and the EPSS score of 3.27% (88th percentile) indicates a moderate likelihood of exploitation attempts. The vulnerability requires network access to the device management interface and valid credentials, limiting realistic risk to exposed management interfaces or LAN-side attackers.
Authenticated OS command injection in Ruijie X30 Pro (firmware X30-PRO-V1_09241521) and RG-EW300T router firmware lets an attacker with a valid management session execute arbitrary OS commands on the device via a crafted POST request to the module_get handler. Publicly available exploit code exists, though there is no evidence of confirmed active exploitation (no CISA KEV listing). EPSS is 2.76% (86th percentile), suggesting elevated but not mass-exploitation risk; the CVSS vector indicates at least low-privileged authentication (PR:L) is required and user interaction is not.
OS command injection in the Ruijie RG-EW1800GX and RG-EW300R router firmware allows an authenticated attacker to execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set handler backed by /usr/local/lua/dev_config/config_retain.lua. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N), exploitation is remote, low-complexity, and requires only low-privilege authentication, so the primary barrier is obtaining valid low-level credentials or abusing weak/default logins; no user interaction is needed. Publicly available exploit code exists and the vulnerability is detailed in a public GitHub advisory, but there is no confirmation that it is being actively exploited (not listed on CISA KEV); EPSS is 2.91% (87th percentile), indicating elevated relative likelihood of exploitation activity. The risk profile is a credible, actionable priority but not a drop-everything emergency.
Authenticated OS command injection in Ruijie RG-EW1200G PRO wireless routers (firmware V1.00, V2.00, V3.00 and V4.00) allows a low-privileged user of the device management interface to execute arbitrary operating-system commands through a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua, yielding high confidentiality, integrity and availability impact (CVSS 8.8). Per the assessed vector (AV:N/AC:L/PR:L/UI:N), the attacker must first reach the management interface and hold at least low-level authenticated access, which is the primary limiting factor; no user interaction is required and attack complexity is low. Publicly available exploit code exists (a dedicated GitHub proof-of-concept write-up plus mirrored exploit artifacts), and EPSS is 2.91% (87th percentile), indicating elevated but not top-tier predicted exploitation likelihood; there is no CISA KEV entry confirming active exploitation, and no vendor-released patch has been identified at time of analysis.
Authenticated OS command injection in Ruijie M18 EW_3.0(1)B11P226 firmware (with the same code path in RG-EW300G Pro EW_3.0(1)B11P219) lets a low-privileged authenticated attacker execute arbitrary shell commands on the device by sending a crafted POST request to the module_set function in /usr/local/lua/dev_sta/nbr_cwmp.lua. Exploitation requires network reachability to the device management interface plus valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N, score 8.8), and no user interaction is needed. Publicly available exploit code exists and the EPSS score is 2.84% (86th percentile), so risk is real but this is a credible, not top-tier emergency, priority - exposure drops sharply for devices whose management UI is not reachable from untrusted networks.
Authenticated command injection in Ruijie RG-BCR600W firmware allows low-privileged users to execute arbitrary OS commands by sending a crafted POST request to the run_tcpdump action in the LuCI web interface. Exploitation requires network access to the device's management interface and a valid low-privilege session (CVSS PR:L), with risk magnified by default or weak credentials. EPSS is 2.44% (84th percentile), indicating elevated but not critical risk; no active exploitation in CISA KEV and no public exploit code identified at time of analysis.
Authenticated OS command injection in Ruijie RG-EW1200 (firmware 3.0(1)B11P227) and RG-X60 (firmware 3.0(1)B11P237) routers lets a network-reachable attacker who already holds low-privilege credentials run arbitrary commands on the device by sending a crafted POST request to the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua. Publicly available exploit code exists and the EPSS score is 2.91% (87th percentile), but there is no confirmed active exploitation (the CVE is not in CISA KEV). Impact per the assessed vector is high - full loss of confidentiality, integrity, and availability on the affected device - yet exploitation first requires valid credentials or a session, so this is a credible mid-tier priority rather than an emergency.
Command injection in Ruijie RG-EW1200 and RG-EW300 Pro router firmware lets authenticated network attackers execute arbitrary operating system commands through a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua. The vulnerable builds are RG-EW1200 firmware 3.0(1)B11P227 and RG-EW300 Pro firmware 3.0(1)B11P219, and exploitation requires network reachability to the web/management interface plus low-privilege credentials (CVSS PR:L). Publicly available exploit code exists, and EPSS is 2.92% (87th percentile), but there is no CISA KEV entry confirming active exploitation; the independent assessment rates this as elevated-priority for affected SOHO router operators rather than an internet-wide emergency.
Authenticated command injection in Ruijie Reyee OS (and the affected RG-EW1800GX PRO, RG-EAP602, RG-EST310 V2 and RG-YST250F firmware builds) lets a low-privileged user who can reach the device's HTTP management interface execute arbitrary OS commands by sending a crafted POST request to the module_set handler backed by /usr/local/lua/dev_sta/nbr_cwmp.lua. Because the vulnerable path is part of the CWMP/TR-069 remote-management module, exposure is concentrated in devices with that service enabled; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C/I/A:H) scores 8.8, reflecting full compromise of confidentiality, integrity and availability once valid credentials are supplied. Exploitation requires network reachability and valid low-privilege authentication rather than being unauthenticated, and reports point to a public technical write-up of the flaw; EPSS is 2.05% (81st percentile), indicating moderate but not top-tier predicted exploitation activity, and no public exploit code has been identified at time of analysis.
Authenticated OS command injection in the Ruijie RG-BCR600W branch/SOHO router allows a remote attacker who already holds valid management credentials to execute arbitrary operating-system commands on the device by sending a crafted POST request to the check_changes action handled by /usr/lib/lua/luci/controller/admin/common.lua. Successful exploitation yields full compromise of confidentiality, integrity and availability of the router (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). The attack is not viable against devices whose LuCI web management interface is unreachable or protected by strong credentials, but risk rises sharply where the UI is exposed to untrusted networks or still uses default/weak logins; EPSS is 2.38% (84th percentile) and no public exploit code has been identified at time of analysis, with no CISA KEV listing.
Authenticated append-style command-injection Ruijie APs (AP_RGOS 11.1.x) allows an authenticated web user to execute appended shell expressions as root, enabling file disclosure, device disruption, and potential network pivoting via the command parameter to the web_action.do endpoint.
A vulnerability in the Ruijie RG-ES series switch firmware ESW_1.0(1)B1P39 enables remote attackers to fully bypass authentication mechanisms, providing them with unrestricted access to alter. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was identified in Ruijie WS7204-A 2017.06.15. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Buffer overflow vulnerability in Ruijie RG-NBR2600S Gateway 10.3(4b12) due to the lack of length verification, which is related to the configuration of source address NAT rules. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker message. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in Ruijie NBR3000D-E Gateway allows a remote attacker to obtain sensitive information via the /tool/shell/postgresql.conf component. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insecure Permissions vulnerability in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release (9736) allows a remote attacker to gain privileges via the login check state component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Ruijie EG2000K 11.1(6)B2 and classified as critical. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in Ruijie RG-UAC 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in Ruijie RG-UAC 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Ruijie RG-UAC up to 20240516. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-UAC up to 20240516. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-UAC up to 20240516. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-UAC up to 20240516 and classified as critical.php. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been found in Ruijie RG-UAC up to 20240516 and classified as critical. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240506. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240506. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240506. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240506. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-UAC up to 20240428. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-UAC up to 20240428. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-UAC up to 20240428. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-UAC up to 20240428 and classified as critical.php. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been found in Ruijie RG-UAC up to 20240428 and classified as critical. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240428. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240428. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240428. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240428. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-UAC up to 20240428. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240419.php. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrator password reset vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, has been found in Ruijie RG-EG350 up to 20240318. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as critical was found in Ruijie RG-EG350 up to 20240318. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-NBS2009G-P up to 20240305. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-NBS2009G-P up to 20240305. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Ruijie WS6008 v1.x v2.x AC_RGOS11.9(6)W3B2_G2C6-01_10221911 and WS6108 v1.x AC_RGOS11.9(6)W3B2_G2C6-01_10221911 was discovered to contain a command injection vulnerability via the function downFiles. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to incorrect filtering. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Ruijie RG-EW1200G 1.0(1)B1P5. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW_3.0(1)B11P204, RG-NBS and RG-S1930 series switches SWITCH_3.0(1)B11P218, RG-EG series. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
A vulnerability was found in Ruijie RG-BCR860 2.5.13 and classified as critical. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Ruijie RG-EW1200G EW_3.0(1)B11P204. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A high-privileged authenticated attacker can inject and execute arbitrary operating-system commands on the Ruijie RG-EW3000GX router running firmware EW_3.0(1)B11P380, through the user_list_note functionality that manipulates the Name argument resolved from /etc/rg_config/admin. The vulnerability is network-reachable and requires no user interaction, but the CVSS vector (PR:H) confirms it is only exploitable after obtaining administrator credentials for the device management interface, so anonymous internet attackers cannot reach it directly. Publicly available exploit code exists (a GitHub proof-of-concept for the RG-EW3000GX user_list_note flaw), which materially raises the likelihood of post-authentication abuse, particularly on routers whose management plane is exposed to the WAN or protected by weak/default admin passwords; no CISA KEV entry has been reported for this CVE.
OS command injection in the Ruijie RG-EW3000GX router (firmware EW_3.0(1)B11P380) lets an attacker who already holds a valid administrator session execute arbitrary shell commands on the device by injecting metacharacters into the data.url argument of a configChange request handled by the cc_set function in unifyframe-sgi.elf. Exploitation is remote and low-complexity once admin access is obtained, and publicly available exploit code exists (PoC disclosed via GitHub and VulDB), though there is no CISA KEV confirmation of active exploitation. Because the CVSS vector carries PR:H and the independent assessment confirms the configChange/cc_set path is not reachable pre-authentication, this is a real but privilege-gated vulnerability rather than an unauthenticated takeover.
Command injection in the Ruijie EG105G-P 2.340 gateway router allows authenticated remote attackers to execute arbitrary OS commands by manipulating the params.target argument of the nslookup function in the /cgi-bin/luci/api/diagnose JSON-RPC endpoint. Publicly available exploit code exists, the vendor did not respond to coordinated disclosure, and successful exploitation yields full confidentiality, integrity, and availability impact on the device.
OS command injection in Ruijie Networks' AP180 series indoor wall-plate wireless access points (RG-AP180) lets an attacker who has already authenticated to the device CLI execute arbitrary operating-system commands on the access point. Because CLI login is a hard prerequisite (CVSS 4.0 vector PR:H, and the independent assessment confirms PR:H under CVSS 3.1), this is not a pre-authentication or remote-unauthenticated attack path; exposure depends on whether the CLI is reachable from untrusted networks and whether default, shared, or weak administrative credentials are in use. There is no confirmed active exploitation (CISA KEV is not indicated), no public exploit code identified at time of analysis, and the EPSS score is modest at 1.41% (72nd percentile), so this is a moderate real-world risk rather than an urgent priority.
OS command injection in Ruijie RG-S1930 switch firmware 3.0(1)B11P230 (and the related RG-NBS5100-24GT4SFP firmware 3.0(1)B11P248) allows an authenticated low-privilege attacker to execute arbitrary operating-system commands through a crafted POST request to the module_update handler in /usr/local/lua/dev_config/ace_sw.lua. Successful exploitation yields full compromise of the device's confidentiality, integrity, and availability, and publicly available exploit code exists (EPSS 2.07%, 81st percentile), making this an actionable priority for any organization with these switches exposed on a reachable management plane.
OS command injection in the Ruijie RG-BCR860 wireless router (firmware 2.5.13) lets an authenticated attacker execute arbitrary commands on the underlying operating system by sending a crafted POST request to the action_diagnosis endpoint of the LuCI web management interface. Because the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N, exploitation requires only network reachability to the admin interface and low-privileged credentials - meaning default or weak administrator passwords, or any compromised low-privilege account, materially elevate risk - and needs no user interaction. Publicly available exploit code exists (a public write-up and PoC are linked from the references), and EPSS places the 30-day exploitation probability at 2.64% (85th percentile), which is high relative to the broader CVE population, although there is no confirmed active exploitation (CISA KEV) at time of analysis.
OS command injection in the Ruijie RG-BCR600W router firmware (build 1.0.4.4468) lets an attacker who already holds valid low-privilege credentials execute arbitrary shell commands on the device by sending a crafted POST request to the get_wanobj handler in /usr/lib/lua/luci/controller/admin/common.lua. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N) and carries an EPSS score of roughly 3.14% (88th percentile), and publicly available exploit code exists - though no CISA KEV entry confirms active exploitation. Exploitation is conditional rather than anonymous: the attacker must be able to reach the web management interface and authenticate, so risk rises sharply wherever the admin panel is exposed beyond the LAN or default credentials remain in place.
Authenticated command execution in Ruijie X60 PRO router firmware (RG-X60 PRO V1.00/V2.00, build 1.021.2014, with RG-EW1200 firmware also listed via CPE) allows an attacker who can reach the device's web/m anagement backend to run arbitrary OS commands on the router by submitting a crafted POST request to the module_get routine in /usr/local/lua/dev_sta/networkConnect.lua. The flaw is a CWE-78 OS command injection; the assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates low-privilege credentials on the management interface are required, but no user interaction is needed and successful exploitation yields full compromise of confidentiality, integrity, and availability on the device. Publicly available exploit code exists (a detailed GitHub write-up for CVE-2025-56124), and EPSS sits at 1.30% (70th percentile), so exploitation is plausible for attackers with management-plane access even though no confirmed in-the-wild activity is reported. No vendor-released patch was identified at time of analysis.
OS command injection in Ruijie RG-EW1200G PRO router firmware (V1.00/V2.00/V3.00/V4.00, with the related RG-EW1300G also listed via CPE) lets an authenticated, low-privilege user send a crafted POST request to the module_get handler that reaches /usr/local/lua/dev_sta/networkConnect.lua, where a parameter is passed unsanitized into a shell command - resulting in arbitrary command execution as the device's web/Lua process. Successful exploitation yields full loss of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV). EPSS is 2.64% (85th percentile), indicating elevated but not top-tier likelihood of exploitation; the practical barrier is that the attacker needs at least low-privilege credentials and network reachability to the management interface, so devices with LAN-only, non-default-credentialed admin access are substantially less exposed.
OS command injection in Ruijie RG-EW1800GX PRO (and related RG-EW1800GX / RG-EW300N) router firmware lets an attacker who already holds valid low-privilege credentials execute arbitrary OS commands on the device by sending a crafted POST request to the module_get handler backed by /usr/local/lua/dev_sta/networkConnect.lua. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, exploitation is remote but gated on authenticated access - on these consumer/SOHO routers the management panel is normally LAN-only, so WAN exploitation depends on remote administration being enabled or the panel being internet-exposed. Publicly available exploit code exists (a GitHub PoC writeup plus OneDrive payload links), and EPSS sits at ~2.64% (85th percentile), indicating elevated but not top-tier predicted exploitation; it is not a confirmed actively exploited (CISA KEV) issue.
Authenticated OS command injection in the Ruijie X30-PRO (and RG-EST310) firmware allows a low-privileged user to execute arbitrary commands on the device by sending a single crafted POST request to the 'module_set' operation handled by /usr/local/lua/dev_sta/nbr_cwmp.lua. According to the CVSS vector (AV:N/AC:L/PR:L/UI:N), exploitation is remote, low complexity, and requires only valid low-level credentials against the management service, with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists, and the EPSS score of 3.05% (87th percentile) indicates elevated relative risk, though there is no confirmation of active exploitation.
OS command injection in Ruijie M18 EW and RG-EW1300G router firmware allows a remote attacker holding a valid low-privilege management session (CVSS PR:L) to run arbitrary OS commands as the device through a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua. The assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) and the independent assessment agree that exploitation is conditional rather than fully unauthenticated: the attacker must first reach the web/management interface and obtain credentials or a session, with exposure highest where remote administration is enabled. Publicly available exploit code exists (a GitHub proof-of-concept/advisory repository), but there is no CISA KEV listing confirming active exploitation, and EPSS is 2.57% (85th percentile), indicating a credible but conditional priority.
Authenticated OS command injection in Ruijie Reyee OS firmware for wireless bridges and access points - including the RG-YST250F, RG-EST310 V2, RG-EAP602 and related RG-YST/EST series devices running Reyee OS 219/221 builds - allows a low-privilege user who can reach the LuCI web management interface to execute arbitrary shell commands on the device by sending a crafted POST request that abuses the pwdmodify function in /usr/lib/lua/luci/modules/common.lua. Because the injected command runs with the privileges of the web server backend (typically root on these embedded platforms), a successful attacker gains full control of the device's confidentiality, integrity and availability, consistent with the assessed CVSS:3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no CISA KEV listing confirming active exploitation and EPSS is modest at 1.66% (76th percentile), but a public GitHub advisory repository documents the flaw along with reproduction detail, so the issue should be treated as a credible mid-tier priority rather than a critical fire-drill - most urgent for operators who have left the management interface reachable from untrusted networks or who still permit default or weak administrative credentials.
OS command injection in the Ruijie RG-BCR860 router firmware (build 2.5.13-r2224) lets attackers with a valid low-privilege session on the web management interface execute arbitrary OS commands on the device by sending a crafted POST request to the network_set_wan_conf endpoint. The flaw resides in the LuCI controller file /usr/lib/lua/luci/controller/admin/netport.lua and carries a CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning authentication is required but no user interaction is needed. Publicly available exploit code exists (EPSS 3.05%, percentile 87%), but there is no CISA KEV confirmation of active exploitation at time of analysis; the practical risk is highest where the router's management interface is exposed beyond a trusted LAN segment.
OS command injection in the Ruijie RG-BCR600W router firmware allows an attacker who holds a low-privilege authenticated session on the web management interface to run arbitrary operating-system commands by sending a crafted POST request to the submit_wifi action handled by /usr/lib/lua/luci/controller/admin/common_quick_config.lua. Successful exploitation yields full compromise of confidentiality, integrity, and availability of the device (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the practical risk is highest where the admin panel is reachable from the internet or an untrusted LAN segment and where default or weak credentials remain in place. EPSS sits at roughly 2.25% (83rd percentile), indicating elevated relative attention but not a mass-exploitation event, and no public exploit identified at time of analysis; this is a credible above-average priority for operators of the affected hardware rather than an emergency.
Authenticated OS command injection in Ruijie RG-EW1800GX (firmware B11P226) and RG-EW300R (firmware B11P301) routers lets an attacker who already holds credentials on the device execute arbitrary shell commands by sending a crafted POST request to the module_get action handled by /usr/local/lua/dev_sta/networkConnect.lua. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) confirms network reachability and low attack complexity but requires some form of authentication (PR:L), which is the main practical barrier; publicly available exploit code exists (no CISA KEV listing, so active exploitation is not confirmed), and EPSS sits at 2.57% (85th percentile), indicating a modest but above-average likelihood of exploitation relative to the wider CVE population. Devices with a WAN-exposed management interface, remote management enabled, or weak/default admin credentials are materially more exposed than LAN-only, strongly-authenticated deployments.
OS command injection in Ruijie wireless access point firmware based on Reyee OS - including RG-YST250F, RG-EST310 v2 and RG-EAP602 builds - lets an authenticated attacker with low-privilege management credentials execute arbitrary operating-system commands on the device via a crafted POST request to the pwdmodify handler in /usr/lib/lua/luci/modules/common.lua. The flaw rates CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), and EPSS is 1.66% (~76th percentile), indicating meaningful but not top-tier exploitation likelihood; no public exploit code or confirmed actively exploited status (CISA KEV) was identified at time of analysis. Practical risk depends heavily on whether the web management interface is exposed beyond a trusted admin VLAN, since valid credentials are a prerequisite.
OS command injection in Ruijie X30-PRO (firmware X30-PRO-V1_09241521) and Ruijie RG-EW300 Pro (firmware 3.0(1)b11p219) allows a low-privilege authenticated attacker to execute arbitrary OS commands via a crafted POST request to the module_get function in /usr/local/lua/dev_sta/networkConnect.lua. Publicly available exploit code exists, and the EPSS score is 2.57% (85th percentile), indicating a moderate likelihood of exploitation, though no active exploitation has been confirmed (not listed in CISA KEV). The vulnerability is remotely exploitable with low complexity but requires valid credentials to the device's web management interface.
Authenticated OS command injection in Ruijie RG-EW1800GX PRO (firmware 3.0(1)B11P226) and RG-EW300N (firmware 3.0(1)B11P300) routers allows an attacker holding a valid low-privilege management session to execute arbitrary shell commands on the device by sending a crafted POST request to the module_set handler. Because the injected commands run with the privileges of the router's web/config service, a successful exploit yields full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), enabling configuration tampering, credential theft, traffic interception, and potential use of the device as a pivot into the LAN. Publicly available exploit code exists (including a detailed write-up and proof-of-concept hosted on OneDrive and GitHub), and EPSS sits at 2.57% (85th percentile), so exploitation is feasible for anyone who can authenticate to the management interface, though reachability of that interface (typically LAN-facing unless remote administration is enabled) and the requirement for valid credentials remain the main gates.
Authenticated OS command injection in the Ruijie RG-BCR600W router firmware allows a logged-in, low-privilege user to run arbitrary shell commands on the device by sending a crafted POST request to the restart_modules action implemented in /usr/lib/lua/luci/controller/admin/common.lua. The issue is rated CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and classified CWE-78, with EPSS at 1.98% (~80th percentile) indicating a modest but non-trivial likelihood of exploitation attempts in the wild. Exploitation is not pre-authentication: attackers must first reach the web management interface and hold valid low-privilege credentials, so exposure hinges on whether the device's admin plane is reachable from untrusted networks; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Authenticated OS command injection in Ruijie RG-EW1200G PRO routers running firmware V1.00, V2.00, V3.00 or V4.00 lets a remote attacker with low-privilege credentials execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set action handled in /usr/local/lua/dev_sta/nbr_cwmp.lua. Publicly available exploit code exists (a GitHub vulnerability report plus linked OneDrive proof-of-concept artifacts), and EPSS rates the flaw at 2.76% (86th percentile), but it is not listed in CISA KEV, so active exploitation is not confirmed. Because the CVSS vector is AV:N/PR:L/UI:N with high C/I/A impact, the attacker must first reach the router's management interface and hold valid (even low-level) credentials, meaning LAN-restricted management and strong unique credentials materially reduce exposure.
Authenticated command injection in Ruijie X30-PRO and RG-EW300 PRO router firmware allows an attacker with low-privileged credentials to execute arbitrary OS commands via a crafted POST request to the module_get function in /usr/local/lua/dev_sta/host_access_delay.lua. Publicly available exploit code exists, and the EPSS score of 3.27% (88th percentile) indicates a moderate likelihood of exploitation attempts. The vulnerability requires network access to the device management interface and valid credentials, limiting realistic risk to exposed management interfaces or LAN-side attackers.
Authenticated OS command injection in Ruijie X30 Pro (firmware X30-PRO-V1_09241521) and RG-EW300T router firmware lets an attacker with a valid management session execute arbitrary OS commands on the device via a crafted POST request to the module_get handler. Publicly available exploit code exists, though there is no evidence of confirmed active exploitation (no CISA KEV listing). EPSS is 2.76% (86th percentile), suggesting elevated but not mass-exploitation risk; the CVSS vector indicates at least low-privileged authentication (PR:L) is required and user interaction is not.
OS command injection in the Ruijie RG-EW1800GX and RG-EW300R router firmware allows an authenticated attacker to execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set handler backed by /usr/local/lua/dev_config/config_retain.lua. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N), exploitation is remote, low-complexity, and requires only low-privilege authentication, so the primary barrier is obtaining valid low-level credentials or abusing weak/default logins; no user interaction is needed. Publicly available exploit code exists and the vulnerability is detailed in a public GitHub advisory, but there is no confirmation that it is being actively exploited (not listed on CISA KEV); EPSS is 2.91% (87th percentile), indicating elevated relative likelihood of exploitation activity. The risk profile is a credible, actionable priority but not a drop-everything emergency.
Authenticated OS command injection in Ruijie RG-EW1200G PRO wireless routers (firmware V1.00, V2.00, V3.00 and V4.00) allows a low-privileged user of the device management interface to execute arbitrary operating-system commands through a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua, yielding high confidentiality, integrity and availability impact (CVSS 8.8). Per the assessed vector (AV:N/AC:L/PR:L/UI:N), the attacker must first reach the management interface and hold at least low-level authenticated access, which is the primary limiting factor; no user interaction is required and attack complexity is low. Publicly available exploit code exists (a dedicated GitHub proof-of-concept write-up plus mirrored exploit artifacts), and EPSS is 2.91% (87th percentile), indicating elevated but not top-tier predicted exploitation likelihood; there is no CISA KEV entry confirming active exploitation, and no vendor-released patch has been identified at time of analysis.
Authenticated OS command injection in Ruijie M18 EW_3.0(1)B11P226 firmware (with the same code path in RG-EW300G Pro EW_3.0(1)B11P219) lets a low-privileged authenticated attacker execute arbitrary shell commands on the device by sending a crafted POST request to the module_set function in /usr/local/lua/dev_sta/nbr_cwmp.lua. Exploitation requires network reachability to the device management interface plus valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N, score 8.8), and no user interaction is needed. Publicly available exploit code exists and the EPSS score is 2.84% (86th percentile), so risk is real but this is a credible, not top-tier emergency, priority - exposure drops sharply for devices whose management UI is not reachable from untrusted networks.
Authenticated command injection in Ruijie RG-BCR600W firmware allows low-privileged users to execute arbitrary OS commands by sending a crafted POST request to the run_tcpdump action in the LuCI web interface. Exploitation requires network access to the device's management interface and a valid low-privilege session (CVSS PR:L), with risk magnified by default or weak credentials. EPSS is 2.44% (84th percentile), indicating elevated but not critical risk; no active exploitation in CISA KEV and no public exploit code identified at time of analysis.
Authenticated OS command injection in Ruijie RG-EW1200 (firmware 3.0(1)B11P227) and RG-X60 (firmware 3.0(1)B11P237) routers lets a network-reachable attacker who already holds low-privilege credentials run arbitrary commands on the device by sending a crafted POST request to the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua. Publicly available exploit code exists and the EPSS score is 2.91% (87th percentile), but there is no confirmed active exploitation (the CVE is not in CISA KEV). Impact per the assessed vector is high - full loss of confidentiality, integrity, and availability on the affected device - yet exploitation first requires valid credentials or a session, so this is a credible mid-tier priority rather than an emergency.
Command injection in Ruijie RG-EW1200 and RG-EW300 Pro router firmware lets authenticated network attackers execute arbitrary operating system commands through a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua. The vulnerable builds are RG-EW1200 firmware 3.0(1)B11P227 and RG-EW300 Pro firmware 3.0(1)B11P219, and exploitation requires network reachability to the web/management interface plus low-privilege credentials (CVSS PR:L). Publicly available exploit code exists, and EPSS is 2.92% (87th percentile), but there is no CISA KEV entry confirming active exploitation; the independent assessment rates this as elevated-priority for affected SOHO router operators rather than an internet-wide emergency.
Authenticated command injection in Ruijie Reyee OS (and the affected RG-EW1800GX PRO, RG-EAP602, RG-EST310 V2 and RG-YST250F firmware builds) lets a low-privileged user who can reach the device's HTTP management interface execute arbitrary OS commands by sending a crafted POST request to the module_set handler backed by /usr/local/lua/dev_sta/nbr_cwmp.lua. Because the vulnerable path is part of the CWMP/TR-069 remote-management module, exposure is concentrated in devices with that service enabled; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C/I/A:H) scores 8.8, reflecting full compromise of confidentiality, integrity and availability once valid credentials are supplied. Exploitation requires network reachability and valid low-privilege authentication rather than being unauthenticated, and reports point to a public technical write-up of the flaw; EPSS is 2.05% (81st percentile), indicating moderate but not top-tier predicted exploitation activity, and no public exploit code has been identified at time of analysis.
Authenticated OS command injection in the Ruijie RG-BCR600W branch/SOHO router allows a remote attacker who already holds valid management credentials to execute arbitrary operating-system commands on the device by sending a crafted POST request to the check_changes action handled by /usr/lib/lua/luci/controller/admin/common.lua. Successful exploitation yields full compromise of confidentiality, integrity and availability of the router (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). The attack is not viable against devices whose LuCI web management interface is unreachable or protected by strong credentials, but risk rises sharply where the UI is exposed to untrusted networks or still uses default/weak logins; EPSS is 2.38% (84th percentile) and no public exploit code has been identified at time of analysis, with no CISA KEV listing.
Authenticated append-style command-injection Ruijie APs (AP_RGOS 11.1.x) allows an authenticated web user to execute appended shell expressions as root, enabling file disclosure, device disruption, and potential network pivoting via the command parameter to the web_action.do endpoint.
A vulnerability in the Ruijie RG-ES series switch firmware ESW_1.0(1)B1P39 enables remote attackers to fully bypass authentication mechanisms, providing them with unrestricted access to alter. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was identified in Ruijie WS7204-A 2017.06.15. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Buffer overflow vulnerability in Ruijie RG-NBR2600S Gateway 10.3(4b12) due to the lack of length verification, which is related to the configuration of source address NAT rules. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker message. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in Ruijie NBR3000D-E Gateway allows a remote attacker to obtain sensitive information via the /tool/shell/postgresql.conf component. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insecure Permissions vulnerability in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release (9736) allows a remote attacker to gain privileges via the login check state component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Ruijie EG2000K 11.1(6)B2 and classified as critical. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in Ruijie RG-UAC 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in Ruijie RG-UAC 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Ruijie RG-UAC up to 20240516. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-UAC up to 20240516. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-UAC up to 20240516. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-UAC up to 20240516 and classified as critical.php. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been found in Ruijie RG-UAC up to 20240516 and classified as critical. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240506. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240506. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240506. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240506. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-UAC up to 20240428. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-UAC up to 20240428. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-UAC up to 20240428. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-UAC up to 20240428 and classified as critical.php. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been found in Ruijie RG-UAC up to 20240428 and classified as critical. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240428. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240428. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240428. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240428. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-UAC up to 20240428. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240419.php. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrator password reset vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, has been found in Ruijie RG-EG350 up to 20240318. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as critical was found in Ruijie RG-EG350 up to 20240318. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-NBS2009G-P up to 20240305. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in Ruijie RG-NBS2009G-P up to 20240305. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Ruijie WS6008 v1.x v2.x AC_RGOS11.9(6)W3B2_G2C6-01_10221911 and WS6108 v1.x AC_RGOS11.9(6)W3B2_G2C6-01_10221911 was discovered to contain a command injection vulnerability via the function downFiles. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to incorrect filtering. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Ruijie RG-EW1200G 1.0(1)B1P5. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW_3.0(1)B11P204, RG-NBS and RG-S1930 series switches SWITCH_3.0(1)B11P218, RG-EG series. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
A vulnerability was found in Ruijie RG-BCR860 2.5.13 and classified as critical. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Ruijie RG-EW1200G EW_3.0(1)B11P204. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.