X30 Pro Firmware
Monthly
Authenticated OS command injection in the Ruijie X30-PRO (and RG-EST310) firmware allows a low-privileged user to execute arbitrary commands on the device by sending a single crafted POST request to the 'module_set' operation handled by /usr/local/lua/dev_sta/nbr_cwmp.lua. According to the CVSS vector (AV:N/AC:L/PR:L/UI:N), exploitation is remote, low complexity, and requires only valid low-level credentials against the management service, with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists, and the EPSS score of 3.05% (87th percentile) indicates elevated relative risk, though there is no confirmation of active exploitation.
Authenticated OS command injection in Ruijie X30-PRO wireless routers and related Ruijie wireless firmware (RG-EAP602, RG-EST350, RG-EW300 PRO, RG-EST310) allows a low-privileged, logged-in user to execute arbitrary system commands by sending a crafted POST request to the pwdmodify handler implemented in /usr/lib/lua/luci/modules/common.lua. The issue is rated CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), and publicly available exploit code exists - including a dedicated GitHub vulnerability report (flegoity) and accompanying proof-of-concept links - while EPSS sits at 2.66% (roughly the 85th percentile), indicating elevated relative likelihood rather than confirmed active exploitation. Risk concentrates on devices whose web management interface is reachable from untrusted networks; LAN-only or firewalled management interfaces substantially reduce exposure.
OS command injection in Ruijie X30-PRO (firmware X30-PRO-V1_09241521) and Ruijie RG-EW300 Pro (firmware 3.0(1)b11p219) allows a low-privilege authenticated attacker to execute arbitrary OS commands via a crafted POST request to the module_get function in /usr/local/lua/dev_sta/networkConnect.lua. Publicly available exploit code exists, and the EPSS score is 2.57% (85th percentile), indicating a moderate likelihood of exploitation, though no active exploitation has been confirmed (not listed in CISA KEV). The vulnerability is remotely exploitable with low complexity but requires valid credentials to the device's web management interface.
Authenticated command injection in Ruijie X30-PRO and RG-EW300 PRO router firmware allows an attacker with low-privileged credentials to execute arbitrary OS commands via a crafted POST request to the module_get function in /usr/local/lua/dev_sta/host_access_delay.lua. Publicly available exploit code exists, and the EPSS score of 3.27% (88th percentile) indicates a moderate likelihood of exploitation attempts. The vulnerability requires network access to the device management interface and valid credentials, limiting realistic risk to exposed management interfaces or LAN-side attackers.
OS command injection in Ruijie X30-PRO firmware (build X30-PRO-V1_09241521) and related RG-EW300 PRO and RG-EAP602 builds allows an authenticated, low-privilege attacker who can reach the LuCI web management interface to execute arbitrary OS commands through a crafted POST request to the setWisp endpoint handled by /usr/lib/lua/luci/modules/wireless.lua. Publicly available exploit code exists, and EPSS rates the issue at 3.15% (88th percentile), though CISA KEV does not list it as confirmed actively exploited. Successful exploitation yields full confidentiality, integrity, and availability impact on the device (CVSS 8.8), and the practical risk is amplified because SOHO/SMB devices frequently ship with default or weak credentials and may expose management over LAN or WAN.
Authenticated OS command injection in Ruijie X30 Pro (firmware X30-PRO-V1_09241521) and RG-EW300T router firmware lets an attacker with a valid management session execute arbitrary OS commands on the device via a crafted POST request to the module_get handler. Publicly available exploit code exists, though there is no evidence of confirmed active exploitation (no CISA KEV listing). EPSS is 2.76% (86th percentile), suggesting elevated but not mass-exploitation risk; the CVSS vector indicates at least low-privileged authentication (PR:L) is required and user interaction is not.
Authenticated OS command injection in the Ruijie X30-PRO (and RG-EST310) firmware allows a low-privileged user to execute arbitrary commands on the device by sending a single crafted POST request to the 'module_set' operation handled by /usr/local/lua/dev_sta/nbr_cwmp.lua. According to the CVSS vector (AV:N/AC:L/PR:L/UI:N), exploitation is remote, low complexity, and requires only valid low-level credentials against the management service, with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists, and the EPSS score of 3.05% (87th percentile) indicates elevated relative risk, though there is no confirmation of active exploitation.
Authenticated OS command injection in Ruijie X30-PRO wireless routers and related Ruijie wireless firmware (RG-EAP602, RG-EST350, RG-EW300 PRO, RG-EST310) allows a low-privileged, logged-in user to execute arbitrary system commands by sending a crafted POST request to the pwdmodify handler implemented in /usr/lib/lua/luci/modules/common.lua. The issue is rated CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), and publicly available exploit code exists - including a dedicated GitHub vulnerability report (flegoity) and accompanying proof-of-concept links - while EPSS sits at 2.66% (roughly the 85th percentile), indicating elevated relative likelihood rather than confirmed active exploitation. Risk concentrates on devices whose web management interface is reachable from untrusted networks; LAN-only or firewalled management interfaces substantially reduce exposure.
OS command injection in Ruijie X30-PRO (firmware X30-PRO-V1_09241521) and Ruijie RG-EW300 Pro (firmware 3.0(1)b11p219) allows a low-privilege authenticated attacker to execute arbitrary OS commands via a crafted POST request to the module_get function in /usr/local/lua/dev_sta/networkConnect.lua. Publicly available exploit code exists, and the EPSS score is 2.57% (85th percentile), indicating a moderate likelihood of exploitation, though no active exploitation has been confirmed (not listed in CISA KEV). The vulnerability is remotely exploitable with low complexity but requires valid credentials to the device's web management interface.
Authenticated command injection in Ruijie X30-PRO and RG-EW300 PRO router firmware allows an attacker with low-privileged credentials to execute arbitrary OS commands via a crafted POST request to the module_get function in /usr/local/lua/dev_sta/host_access_delay.lua. Publicly available exploit code exists, and the EPSS score of 3.27% (88th percentile) indicates a moderate likelihood of exploitation attempts. The vulnerability requires network access to the device management interface and valid credentials, limiting realistic risk to exposed management interfaces or LAN-side attackers.
OS command injection in Ruijie X30-PRO firmware (build X30-PRO-V1_09241521) and related RG-EW300 PRO and RG-EAP602 builds allows an authenticated, low-privilege attacker who can reach the LuCI web management interface to execute arbitrary OS commands through a crafted POST request to the setWisp endpoint handled by /usr/lib/lua/luci/modules/wireless.lua. Publicly available exploit code exists, and EPSS rates the issue at 3.15% (88th percentile), though CISA KEV does not list it as confirmed actively exploited. Successful exploitation yields full confidentiality, integrity, and availability impact on the device (CVSS 8.8), and the practical risk is amplified because SOHO/SMB devices frequently ship with default or weak credentials and may expose management over LAN or WAN.
Authenticated OS command injection in Ruijie X30 Pro (firmware X30-PRO-V1_09241521) and RG-EW300T router firmware lets an attacker with a valid management session execute arbitrary OS commands on the device via a crafted POST request to the module_get handler. Publicly available exploit code exists, though there is no evidence of confirmed active exploitation (no CISA KEV listing). EPSS is 2.76% (86th percentile), suggesting elevated but not mass-exploitation risk; the CVSS vector indicates at least low-privileged authentication (PR:L) is required and user interaction is not.