OS Command Injection

Ac1206 Firmware versions up to 15.03.06.23 contains a vulnerability that allows attackers to command injection (CVSS 6.3).

OS command injection in the Nuvation Energy Multi-Stack Controller (MSC) management interface allows an authenticated, low-privileged network attacker to execute arbitrary operating system commands on the controller, with high impact to confidentiality, integrity, and availability of the device and its scope of control. The flaw (CWE-78) affects MSC/nPlatform deployments running firmware before 2.5.1; successful exploitation requires network reachability to the controller's management interface plus valid low-privileged credentials per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), so it is access-gated rather than open to unauthenticated attackers. There is no public exploit identified at time of analysis, exploitation has not been confirmed actively exploited (no CISA KEV listing), and EPSS is low at 0.29% (52nd percentile), making this a serious but currently non-mass-exploited OT/ICS issue that is fully remediated by upgrading to firmware 2.5.1.

OS command injection in Nuvation Energy Multi-Stack Controller (MSC) firmware 2.3.8 through 2.5.0 lets an authenticated, low-privileged attacker who can reach the controller's management interface execute arbitrary operating-system commands on the device, with high impact to confidentiality, integrity, and availability of both the controller and connected systems (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H; NVD rates it 9.4 under CVSS 4.0). Exploitation requires valid low-privilege credentials plus network reachability to the management interface, so this is not an unauthenticated remote compromise of default configurations, and the affected MSC is a niche OT/ICS battery-energy-storage controller rather than a broadly deployed enterprise product. No public exploit code has been identified at time of analysis (EPSS 0.29%, ~52nd percentile; not listed in CISA KEV), but the vendor has fixed the issue in version 2.5.1, which should be applied promptly given the severity of post-authentication code execution on grid-adjacent hardware.

Unauthenticated server state pollution in Signal K Server prior to version 2.19.0 lets a network-reachable attacker overwrite the module-global restoreFilePath via the unauthenticated /skServer/validateBackup endpoint, hijacking the administrator's Restore workflow so that attacker-supplied archive contents are written over critical configuration files such as security.json. Overwriting security.json allows creation of a rogue administrator account, which the attacker can then use to reach a separate command-injection flaw in the App Store install path and achieve remote code execution. Publicly available exploit code exists and the vendor explicitly warns Internet-exposed instances to patch immediately, though EPSS remains low at roughly 0.10% (27th percentile); no confirmed active exploitation (CISA KEV) is associated with this issue at time of analysis.

Remote code execution in RAGFlow versions prior to 0.23.0 allows a low-privileged authenticated user (a normal login account) to run arbitrary system commands on the server host by abusing the frontend Canvas CodeExec component. The backend reads stdout returned by the code sandbox and passes it to Python's eval(), so attacker-controlled output is executed outside the intended sandbox isolation; no additional user interaction is required beyond the attacker's own session, and additional endpoints with missing access control or inverted permission logic widen the attack surface for chained exploitation. Publicly available exploit code exists and a vendor patch is available in 0.23.0, which replaces eval() with json.loads/ast.literal_eval; this is a genuine high-priority issue per our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Command injection in the SSDP Request Handler (ssdpcgi_main function) of D-Link DIR-806A firmware 100CNb11 allows remote authenticated attackers to execute arbitrary commands with low integrity and availability impact. Publicly available exploit code exists, but the vulnerability affects only end-of-life firmware with minimal real-world exploitation probability (EPSS 0.11%) due to low privilege requirements and limited scope of impact.

Command injection in D-Link DI-7400G+ firmware 19.12.25A1 allows a remote low-privileged attacker to execute arbitrary OS-level commands via the `cmd` parameter of the `/msp_info.htm?flag=cmd` web endpoint. A public proof-of-concept exploit is available on GitHub, raising the practical threat level above the low EPSS score suggests. No active exploitation has been confirmed by CISA KEV, and the official CVSS 4.0 score of 2.1 appears to significantly understate the impact of arbitrary command execution on a network device.

Command injection in Serverless Framework versions 4.29.0 through 4.29.2 allows remote code execution through the experimental MCP server feature (@serverless/mcp package). Attackers can inject arbitrary shell commands via unsanitized input parameters passed to child_process.exec, achieving RCE under server process privileges. Publicly available exploit code exists (GHSA-rwc2-f344-q6w6). Impact is limited to less than 0.1% of users utilizing the experimental serverless mcp feature. EPSS probability is low at 0.05% (16th percentile).

Command injection in the Edimax BR-6208AC V2 web-based configuration interface (firmware 1.02 and 1.03) allows remote attackers to execute arbitrary OS commands by manipulating routing parameters in the formRoute handler, with no authentication or user interaction indicated as required per the CVSS 4.0 vector. The vendor has confirmed the device is End of Life and has explicitly declined to release any remediation, making hardware replacement the only definitive fix. A public proof-of-concept exploit exists; no CISA KEV listing was identified at time of analysis, and the EPSS score of 0.39% at the 60th percentile suggests limited observed exploitation to date despite PoC availability.

Command injection in the Edimax BR-6208AC V2 web-based configuration interface exposes unauthenticated remote attackers to arbitrary OS command execution by manipulating the `rootAPmac` parameter submitted to the `/goform/formStaDrvSetup` handler. Firmware versions 1.02 and 1.03 are confirmed affected, and Edimax has explicitly stated the device has reached End of Life with no firmware patch forthcoming - making this a permanent, unmitigable vulnerability for any unit still in service. A public proof-of-concept is available, and no public exploit identified at time of analysis in CISA KEV, though the 67th-percentile EPSS score suggests elevated risk relative to the broader CVE population.

OS command injection in the Tenda W6-S wireless router firmware 1.0.0.4(510) allows a remote authenticated attacker to execute arbitrary operating system commands by sending crafted input to the TendaAte function via the /goform/ate endpoint of the ATE (Automatic Test Equipment) diagnostic service. A public proof-of-concept exploit exists on GitHub, raising practical risk despite the low official CVSS 4.0 score of 2.1. No active exploitation has been confirmed by CISA KEV, but EPSS places this at the 76th percentile, reflecting non-trivial exploitation likelihood given POC availability.

Command argument injection in the Tugtainer agent API (POST api/command/run) lets remote attackers append or substitute arbitrary arguments to commands the agent dispatches, potentially achieving command execution or otherwise manipulating Docker on the host. All Tugtainer deployments running versions prior to 1.15.1 are affected, including the Docker-packaged builds identified by the affected CPE; the vendor's CVSS 4.0 vector (8.1, AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) rates it as remotely reachable, low-complexity, and unauthenticated, though the advisory does not confirm whether the agent endpoint enforces a token, so an additional credential requirement cannot be ruled out in hardened setups. No public exploit code and no confirmed active exploitation were identified at time of analysis.

Command injection in D-Link DWR-M920 firmware up to version 1.1.50 allows authenticated remote attackers to execute arbitrary commands via the fota_url parameter in the /boafrm/formLtefotaUpgradeQuectel endpoint. Public exploit code is available, though EPSS exploitation probability remains low at 0.20% percentile, suggesting limited real-world exploitation despite proof-of-concept availability.

Remote command injection in D-Link DWR-M920 routers allows authenticated attackers with low privileges to execute arbitrary commands on the device. The flaw exists in the fota_url parameter of the formLtefotaUpgradeFibocom handler in firmware versions up to 1.1.50. Exploit code is publicly available, but no evidence of active exploitation exists, and EPSS suggests low exploitation probability.

Command injection in TRENDnet TEW-822DRE firmware versions 1.00B21 and 1.01B06 allows authenticated remote attackers with low privileges to execute arbitrary commands on the device. The vulnerability exists in the /boafrm/formWsc endpoint via the peerPin parameter. A publicly available proof-of-concept exploit exists, but no active exploitation has been reported to date (not listed in CISA KEV).

Command injection in the NTPSyncWithHost.cgi endpoint of TRENDnet TEW-800MB firmware 1.0.1.0 allows an authenticated remote attacker to execute arbitrary operating-system commands on the router by manipulating input processed by the sub_F934 function. The CVSS vector specifies PR:L, so the attacker must first hold a valid low-privilege account or an established management session against the device; exploitation is not fully unauthenticated. Publicly available exploit code exists (linked from NVD via a third-party write-up), but the flaw is not confirmed actively exploited (CISA KEV), and exposure is bounded by the single firmware/model combination and the usual LAN-side reachability of a consumer router's management interface.

Command injection in TRENDnet TEW-800MB firmware 1.0.1.0 allows an authenticated low-privilege attacker who can reach the web Management Interface to execute arbitrary operating-system commands through a crafted WizardConfigured parameter in a request to /goform/wizardset. Publicly available exploit code exists, and exploitation is bounded by the need for valid credentials and reachability of the management interface; no CISA KEV entry is provided in the available intelligence. The device is at sharply higher risk if WAN-side remote management is enabled, otherwise exposure is typically limited to the LAN.

Command injection in ZSPACE Z4Pro+ firmware 1.0.0440024 allows an authenticated remote attacker to execute arbitrary OS commands by sending a crafted HTTP POST request to the `/v2/file/safe/close` endpoint, processed by the `zfilev2_api_CloseSafe` function without adequate input sanitization. The attack requires low-level authentication (PR:L per the CVSS 4.0 vector) but no user interaction, and a public proof-of-concept is available on GitHub. No public exploit is actively weaponized and no KEV listing exists, though the PoC lowers the bar for adversaries with network access to the device.

Command injection in ZSPACE Z4Pro+ 1.0.0440024 via the /v2/file/safe/open HTTP POST endpoint allows authenticated remote attackers to execute arbitrary commands with limited impact on confidentiality, integrity, and availability. The vulnerability affects the zfilev2_api_open function and has been publicly disclosed with exploit code available; however, the EPSS score of 0.38% (59th percentile) and CVSS scope constraint (SC:N) suggest limited real-world exploitation risk despite authenticated remote access capability.

Public command injection in ZSPACE Z4Pro+ firmware allows authenticated remote attackers to execute arbitrary commands via the zfilev2_api_SafeStatus function in the /v2/file/safe/status endpoint. Low CVSS base score (2.1) and EPSS (0.38%) reflect limited impact and low exploitation probability, but public POC code exists, increasing risk for targeted attacks. No evidence of active exploitation in the wild.

Authenticated remote code execution affects StreamVault (StreamVault / stream-vault SpiritApplication) releases prior to 251126, where an administrator can inject arbitrary yt-dlp arguments through the /admin/api/saveConfig endpoint. The injected arguments are persisted globally and later concatenated into the yt-dlp command line assembled by YtDlpUtil.java, allowing OS command injection (CWE-78) that executes with the privileges of the StreamVault service when a download job runs. Exploitation requires a valid administrative session (CVSS PR:H), so anonymous remote attackers cannot reach it, but publicly available exploit code exists per the referenced GitHub security advisory GHSA-c747-q388-3v6m; there is no indication of confirmed active exploitation (CISA KEV), and the vulnerable argument-append feature was removed entirely in the subsequent 251226 release.

Authenticated command injection in the Yealink SIP-T21P_E2 IP phone (firmware 52.84.0.15) lets a remote user with normal, non-administrative privileges execute arbitrary operating-system commands by sending a crafted request to the ping utility of the diagnostic component. Because the CVSS vector reports PR:L, exploitation requires only a low-privileged authenticated session, and publicly available exploit code exists, though the EPSS probability remains modest at 0.60% (44th percentile) and the flaw is not listed in CISA KEV. Successful exploitation yields full high-impact compromise of confidentiality, integrity, and availability on the device.

Command injection in the Delight Custom Firmware (CFW) for Nokia Symbian Belle devices lets a local attacker place a crafted .txt file in the device's :\Data directory that the firmware's startup mechanism parses and executes as a boot script, yielding code execution at boot. All affected builds are covered - Delight v1.8 on the Nokia 808, v6.7 on the N8 and C7, v1.3 on the E7, v1.2 on the 700 and 500, v1.1 on the 701, and v1.0 on the 603, E6, Oro, and Vertu Constellation T. Exploitation is unauthenticated but strictly local: it requires write access to :\Data (typically via USB mass-storage mode or an on-device file manager) plus a device reboot to trigger the injected script, and no public exploit code or active exploitation has been identified at time of analysis. NVD scores this 5.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), while this assessment rates the impact higher (C:H/I:H/A:H) given that boot-script execution runs with firmware privileges; real-world risk remains LOW-to-MODERATE because the affected platform is long-discontinued, niche custom firmware with no default remote exposure.

Command injection in JD Cloud BE6500 4.4.1.r4308 via the ddns_name parameter in the /jdcapi endpoint allows authenticated remote attackers to execute arbitrary commands with limited impact (low confidentiality, integrity, and availability). Public exploit code is available. The vendor has not responded to early disclosure notification, and no patch has been released.

Server-side OS command injection in OpenOps versions before 0.6.11 allows an authenticated low-privileged user who can create or edit a workflow using the Terraform block to execute arbitrary commands on the server by supplying malicious HCL content, file paths, or resource/property identifiers that are passed without escaping to the hcledit CLI. The vendor fixed the issue in 0.6.11 (PR #1767) by adding shell-argument escaping and strict identifier validation, and exploitation requires user interaction (UI:R) and high attack complexity (AC:H). No public exploit code or active exploitation has been identified at time of analysis.

OS command injection in Johnson Controls devices can allow a low-privilege authenticated remote attacker to execute arbitrary operating-system commands and gain access to the affected device, resulting in full compromise of confidentiality, integrity, and availability. The vulnerability is High severity (CVSS 4.0 8.7) and requires a network path plus valid low-privilege credentials, with exploitation reportedly limited to certain circumstances. No public exploit identified at time of analysis, and no KEV status or EPSS score was provided in the supplied intelligence.

Command injection in certain Johnson Controls devices allows a low-privilege authenticated attacker to execute arbitrary operating system commands, resulting in high impact to confidentiality, integrity, and availability of the device. Exploitation requires network access to an affected interface and valid credentials, but no user interaction; the exact affected models and endpoints are not specified in the available data. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and the vague description warrants verification against the vendor and CISA advisories.

Remote command injection in Tenda WH450 firmware 1.0.0.18 allows unauthenticated command execution via the ipaddress parameter in the /goform/CheckTools HTTP endpoint. A publicly available proof-of-concept exploit exists, but the EPSS exploitation probability is low (0.25%).

An authenticated command injection vulnerability in Coolify's File Storage Directory Mount Path functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. The vulnerability affects all Coolify versions prior to 4.0.0-beta.451 and has a publicly available proof-of-concept exploit, though current exploitation probability remains relatively low at 0.20% according to EPSS data. Attackers can achieve full remote code execution with root privileges on the host system by exploiting unsanitized input in the file_storage_directory_source parameter.

An authenticated command injection vulnerability in Coolify's Dynamic Proxy Configuration Filename handling allows users with application/service management permissions to execute arbitrary commands as root on managed servers. The vulnerability affects all Coolify versions prior to 4.0.0-beta.451, with a publicly available proof-of-concept exploit and moderate exploitation likelihood (EPSS 20%, percentile 41%). Attackers can achieve full remote code execution with root privileges by injecting shell commands through unescaped proxy configuration filenames.

An authenticated command injection vulnerability in Coolify's PostgreSQL initialization script handling allows attackers with application/service management permissions to execute arbitrary commands as root on managed servers. The vulnerability affects all Coolify versions prior to 4.0.0-beta.451 and enables full remote code execution through unsanitized PostgreSQL init script filenames passed to shell commands. A public proof-of-concept exploit is available, and while not currently in CISA KEV, the vulnerability has a moderate EPSS score of 0.41% indicating some exploitation probability.

A command injection vulnerability in Coolify's Database Import functionality allows authenticated users with application/service management permissions to execute arbitrary system commands as root on managed servers. The vulnerability stems from unsanitized database names being passed directly to shell commands, enabling full remote code execution. A public proof-of-concept exploit is available, and with an EPSS score of 0.41% (61st percentile), this represents a moderate real-world exploitation risk for organizations using vulnerable Coolify versions.

A command injection vulnerability in Coolify's Database Backup functionality allows authenticated users with application/service management permissions to execute arbitrary commands as root on managed servers. The vulnerability affects all Coolify versions prior to 4.0.0-beta.451 and has a publicly available proof-of-concept exploit. With a CVSS score of 9.9 and confirmed exploitation code available, this represents a critical risk for organizations using Coolify to manage their infrastructure.

Local attackers with existing low-privileged access to a Windows host running Mitsubishi Electric GENESIS64, ICONICS Suite, MobileHMI (10.97.2 CFR3 and prior), or MC Works64 (all versions) can tamper with the software keyboard ('keypad') function's configuration file so that it points to an attacker-supplied executable; when a legitimate user next invokes the keypad, that EXE executes in the user's context. The result is arbitrary code execution leading to disclosure, tampering, deletion or destruction of data on the affected PC, or a denial-of-service condition, and the scope change (S:C) reflects that the spawned process is not constrained to the vulnerable component. Exploitation is heavily gated - it requires a pre-existing local foothold, write permission on the keypad configuration file, and a victim actually using the keypad - and there is no public exploit identified at time of analysis, with EPSS at just 0.57% (45th percentile), so this is an access-gated insider/local risk rather than an internet-facing crisis.

Command injection in the Firmware Update Service of the end-of-life D-Link DIR-605 router running firmware 202WWB03 (2.02WW) lets an attacker who holds administrative access to the device's management interface inject and execute arbitrary shell commands on the underlying firmware. Exploitation requires high-privilege access per the CVSS PR:H metric - in practice valid, default, or weak admin credentials, or an admin interface exposed to an untrusted network - and no user interaction is needed. Publicly available exploit code exists (a detailed proof-of-concept writeup is already circulating), and EPSS stands at 10.96% (96th percentile), indicating elevated real-world likelihood; there is no confirmed active exploitation (CISA KEV) at time of analysis, and because the product is no longer supported by D-Link, no vendor patch is expected.

Unauthenticated OS command injection in the WODESYS WD-R608U small-office/home-office router (sold as WDR122B V2.0 and WDR28) allows an attacker positioned on the same LAN or Wi-Fi segment to execute arbitrary system shell commands through the langGet parameter of the adm.cgi web management endpoint. No credentials or user interaction are required - the injected input is passed to a system shell without validation - but exploitation is gated by adjacent-network positioning and by the admin interface being reachable, so the exposure is not internet-scale unless management access has been deliberately published. Only firmware WDR28081123OV1.01 was tested and confirmed vulnerable; the vendor did not respond with a vulnerability or version-range statement, so additional versions may also be affected. No vendor-released patch has been identified, and no public exploit code was identified at the time of analysis; EPSS is 2.70% (85th percentile), reflecting elevated but not top-tier exploitation likelihood.

OS command injection in Ruijie Networks' AP180 series indoor wall-plate wireless access points (RG-AP180) lets an attacker who has already authenticated to the device CLI execute arbitrary operating-system commands on the access point. Because CLI login is a hard prerequisite (CVSS 4.0 vector PR:H, and the independent assessment confirms PR:H under CVSS 3.1), this is not a pre-authentication or remote-unauthenticated attack path; exposure depends on whether the CLI is reachable from untrusted networks and whether default, shared, or weak administrative credentials are in use. There is no confirmed active exploitation (CISA KEV is not indicated), no public exploit code identified at time of analysis, and the EPSS score is modest at 1.41% (72nd percentile), so this is a moderate real-world risk rather than an urgent priority.

Arbitrary code execution in the Zed code editor affects all versions prior to 0.218.2-pre, where Model Context Protocol (MCP) server definitions stored in a project's .zed/settings.json are loaded and executed automatically when the project is opened. An attacker who can deliver a project directory containing a crafted settings.json with a malicious MCP command field can run arbitrary shell commands with the privileges of the user running the IDE, requiring only that the victim open the project (no other interaction). The assessed vector is AV:L/AC:L/PR:N/UI:R with high confidentiality, integrity and availability impact, and publicly available exploit code exists; the risk is genuine and actionable, but exploitation hinges on a social-engineering step to get the victim to open an untrusted project, so patched installs or users who review ./zed/settings.json first are not exposed.

Arbitrary code execution in the Zed code editor (all versions prior to 0.218.2-pre) lets a project's .zed/settings.json define LSP language server entries that embed shell commands, which then execute on the host with the privileges of the user running the IDE. Publicly available exploit code exists, but exploitation is local and interaction-dependent: the victim must open an attacker-seeded project and open a file matching one of the malicious LSP entries without first reviewing the project settings. The assessed vector (AV:L/AC:L/PR:N/UI:R) reflects a moderate-severity, interaction-dependent code execution flaw rather than an internet-facing emergency, and both the upstream worktree trust fix and the documented manual-review workaround neutralize the condition.

Authenticated remote code execution in RiteCMS 3.1.0 allows an attacker holding a high-privileged administrative session to inject OS commands through the parse_special_tags() function in cms/includes/functions.inc.php, resulting in full compromise of confidentiality, integrity, and availability (CVSS 7.2). The CVSS vector (AV:N/AC:L/PR:H/UI:N) confirms the flaw is remotely reachable and needs no user interaction, but it explicitly requires high privileges, meaning an outsider must first obtain valid admin credentials or hijack an admin session; publicly available exploit code exists, though there is no indication of confirmed active exploitation (no CISA KEV entry). Practical exposure is limited by the product's rarity, as only installations running version 3.1.0 are affected.

Authenticated attackers with low privileges can upload a crafted PHP file to Pagekit CMS 1.0.18 via the /storage/poc.php endpoint, leading to remote code execution on the server. Publicly available exploit code exists but no confirmed active exploitation (CISA KEV) is reported; EPSS is low at 0.53%, indicating a serious but not emergency-level threat. The vulnerability requires a valid account and improper file-type validation, and the independently assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 8.8) reflects high impact with scope unchanged.

OS command injection in the systeminformation Node.js library on Windows allows arbitrary PowerShell command execution when attacker-controlled input reaches the optional `drive` parameter of the fsSize() function. Versions prior to 5.27.14 are affected, but exploitability is conditional: the Node.js process must be running on Windows (win32) and the host application must actually forward user-supplied drive or volume values into fsSize() - applications that call the function with no argument or with hardcoded values, and all non-Windows deployments, are not vulnerable. Publicly available exploit code exists (published alongside advisory GHSA-wphj-fx3q-84ch), though no confirmed active exploitation (CISA KEV) has been reported at time of analysis; the CVSS base score is 8.1 with AC:H precisely because the attack hinges on application data flow rather than a trivially reachable endpoint. Unauthenticated at the library level (PR:N), remote delivery is possible when the vulnerable function is reachable through a web or API surface.

Command injection in the TOTOLINK A3300R Wi-Fi router affects firmware version V17.0.0cu.596_B20250515, where the NTPSyncWithHost function fails to sanitize the host_time parameter, letting an attacker run arbitrary shell commands on the device. The CVSS vector (AV:A, PR:N, UI:N) means the attacker must be on the same local network segment (connected to the router's LAN or Wi-Fi) and needs no authentication or user interaction, so the realistic threat is an on-network or post-foothold attacker rather than a broad internet-wide compromise. Publicly available exploit code exists, though there is no confirmation of active exploitation in this data; our independent assessment rates the impact as high for confidentiality, integrity, and availability because command execution on a router typically yields full control of the device.

Command injection in the TOTOLINK N200RE router firmware (V9.3.5u.6437_B20230519) lets an attacker on the same local network execute arbitrary shell commands on the device through the setOpModeCfg handler's hostName parameter. Because the vector is AV:A with PR:N/UI:N, no credentials or user interaction are needed, but the attacker must already be on the device's Wi-Fi or wired LAN segment (for example a guest, neighbor, or rogue client sharing the broadcast domain) rather than reaching it from the internet. Publicly available exploit code exists (a proof-of-concept PDF is linked from the NVD record), and the flaws were confirmed as command injection per CWE-77; there is no evidence of confirmed in-the-wild exploitation and the vendor has published no fixed firmware in the supplied references.

Unauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system commands on the device by manipulating the 'params' argument handled by /usr/sbin/http_eshell_server, which backs the product's DOCKER feature. The vendor was contacted about the flaw but did not respond, and publicly available exploit code exists, including a public write-up; EPSS is 18.62% (97th percentile), so exploitation risk is elevated for any unit whose management/Docker HTTP interface is network-reachable. Impact is high across confidentiality, integrity and availability, though real-world exposure is limited by the small deployment base of this product and by whether the interface is internet- or LAN-reachable.

Command injection in sgwbox N3 firmware 2.0.25 allows unauthenticated remote attackers to execute arbitrary operating system commands by sending crafted input to the NETREBOOT interface handled by /usr/sbin/http_eshell_server. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.9) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) both confirm no authentication, no user interaction, and no special configuration are required, making any instance exposing this interface reachable directly attackable. Publicly available exploit code exists and EPSS is 18.62% (97th percentile), signaling elevated exploitation likelihood; the vendor was contacted but did not respond, so no vendor-released patch was identified at time of analysis.

Command injection in the SHARESERVER component of sgwbox N3 NAS firmware 2.0.25 lets remote, unauthenticated attackers execute operating-system commands on the device by manipulating the 'params' argument, yielding high impact to confidentiality, integrity, and availability. Publicly available exploit code exists (a proof-of-concept write-up is linked in the references), and EPSS rates the likelihood of exploitation at roughly 16.5% (97th percentile), though the vulnerability is not confirmed actively exploited (not in CISA KEV). The vendor was contacted about the disclosure and did not respond, and no vendor-released patch has been identified, so exposure is governed almost entirely by whether the SHARESERVER interface is reachable from untrusted networks.

Command injection in the DHCP daemon of D-Link DIR-860L B1 and DIR-868L B1 routers running firmware 203b01/203b03 allows an attacker who can reach the device on the same broadcast domain to execute arbitrary shell commands as root by supplying a crafted Hostname (DHCP option 12) string in a DHCP request. Exploitation requires LAN adjacency rather than Internet reachability - DHCP is not routable, so the source data's 'remote' label is constrained to local-network delivery - but needs no authentication and no user interaction against a default-running service (our assessment vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. high confidentiality, integrity and availability impact). Publicly available exploit code exists and is linked from the references, EPSS is 3.80% (90th percentile), and there is no CISA KEV entry or other confirmation of active in-the-wild exploitation; no vendor-released patch has been identified, and both models are end-of-life hardware revisions.

Command injection in DedeBIZ up to version 6.5.9 allows authenticated high-privilege administrators to execute arbitrary system commands via the /src/admin/catalog_add.php endpoint. The vulnerability requires high-privilege authentication (PR:H in CVSS v4.0) and has publicly available exploit code, but real-world risk is constrained by the authentication requirement and limited scope of impact (CVSS 2.0, EPSS 0.28%).

OS command injection in TOTOLINK X5000R firmware 9.1.0cu.2089_B20211224 allows authenticated remote attackers to execute arbitrary system commands via the User parameter in the /cgi-bin/cstecgi.cgi exportOvpn function. The vulnerability requires valid login credentials but results in complete system compromise once authenticated. Public exploit code is available, and the CVSS score of 2.1 significantly underrepresents the true risk due to the low-impact scoring parameters masking the severity of unauthenticated command execution in a network-accessible management interface.

Operating-system command injection in Fireshare 1.2.30 and earlier lets a user with upload privileges - or any unauthenticated visitor when the non-default 'Public Uploads' setting is turned on - embed shell metacharacters or traversal sequences in an uploaded video's filename, which the application concatenates directly into a shell command. Successful exploitation yields remote code execution in the context of the Fireshare service and allows writing files to arbitrary directories via path traversal. The flaw is rated 9.8 by NVD and assessed at the same impact level (with the caveat that authentication is normally required), and the vendor has shipped a definitive fix in 1.3.0; EPSS places near-term exploitation likelihood at roughly 0.7% (51st percentile), and no public exploit code has been identified at time of analysis.

A command injection vulnerability in gardenctl allows attackers with administrative privileges in a Gardener project to inject malicious commands through crafted credential values when non-POSIX shells (Fish, PowerShell) are used by service operators. The vulnerability affects gardenctl versions 2.11.0 and below, enabling attackers to break out of string contexts and execute arbitrary commands with potentially high impact on confidentiality, integrity, and availability. With an EPSS score of only 0.06% and no known exploitation in the wild or public POC, this represents a lower real-world risk despite the high CVSS score of 8.4.

Authenticated users of IBM Aspera Orchestrator 4.0.0 through 4.1.0 can inject operating-system commands that the application then executes with elevated privileges, giving a low-privileged account full control over the host (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the CVSS vector carries PR:L, exploitation requires a valid login on the Orchestrator instance; the attacker does not need victim interaction and can reach the vulnerable component over the network, making this primarily a post-compromise or credentialed-insider escalation path rather than a mass internet-exploitation candidate. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.48% (39th percentile), so immediate broad scanning activity is not indicated, but the impact once credentials are in hand is complete compromise of confidentiality, integrity, and availability.

OS command injection in Ruijie RG-S1930 switch firmware 3.0(1)B11P230 (and the related RG-NBS5100-24GT4SFP firmware 3.0(1)B11P248) allows an authenticated low-privilege attacker to execute arbitrary operating-system commands through a crafted POST request to the module_update handler in /usr/local/lua/dev_config/ace_sw.lua. Successful exploitation yields full compromise of the device's confidentiality, integrity, and availability, and publicly available exploit code exists (EPSS 2.07%, 81st percentile), making this an actionable priority for any organization with these switches exposed on a reachable management plane.

OS command injection in the Ruijie RG-BCR860 wireless router (firmware 2.5.13) lets an authenticated attacker execute arbitrary commands on the underlying operating system by sending a crafted POST request to the action_diagnosis endpoint of the LuCI web management interface. Because the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N, exploitation requires only network reachability to the admin interface and low-privileged credentials - meaning default or weak administrator passwords, or any compromised low-privilege account, materially elevate risk - and needs no user interaction. Publicly available exploit code exists (a public write-up and PoC are linked from the references), and EPSS places the 30-day exploitation probability at 2.64% (85th percentile), which is high relative to the broader CVE population, although there is no confirmed active exploitation (CISA KEV) at time of analysis.

OS command injection in the Ruijie RG-BCR600W router firmware (build 1.0.4.4468) lets an attacker who already holds valid low-privilege credentials execute arbitrary shell commands on the device by sending a crafted POST request to the get_wanobj handler in /usr/lib/lua/luci/controller/admin/common.lua. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N) and carries an EPSS score of roughly 3.14% (88th percentile), and publicly available exploit code exists - though no CISA KEV entry confirms active exploitation. Exploitation is conditional rather than anonymous: the attacker must be able to reach the web management interface and authenticate, so risk rises sharply wherever the admin panel is exposed beyond the LAN or default credentials remain in place.

Authenticated command execution in Ruijie X60 PRO router firmware (RG-X60 PRO V1.00/V2.00, build 1.021.2014, with RG-EW1200 firmware also listed via CPE) allows an attacker who can reach the device's web/m anagement backend to run arbitrary OS commands on the router by submitting a crafted POST request to the module_get routine in /usr/local/lua/dev_sta/networkConnect.lua. The flaw is a CWE-78 OS command injection; the assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates low-privilege credentials on the management interface are required, but no user interaction is needed and successful exploitation yields full compromise of confidentiality, integrity, and availability on the device. Publicly available exploit code exists (a detailed GitHub write-up for CVE-2025-56124), and EPSS sits at 1.30% (70th percentile), so exploitation is plausible for attackers with management-plane access even though no confirmed in-the-wild activity is reported. No vendor-released patch was identified at time of analysis.

OS command injection in Ruijie RG-EW1200G PRO router firmware (V1.00/V2.00/V3.00/V4.00, with the related RG-EW1300G also listed via CPE) lets an authenticated, low-privilege user send a crafted POST request to the module_get handler that reaches /usr/local/lua/dev_sta/networkConnect.lua, where a parameter is passed unsanitized into a shell command - resulting in arbitrary command execution as the device's web/Lua process. Successful exploitation yields full loss of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV). EPSS is 2.64% (85th percentile), indicating elevated but not top-tier likelihood of exploitation; the practical barrier is that the attacker needs at least low-privilege credentials and network reachability to the management interface, so devices with LAN-only, non-default-credentialed admin access are substantially less exposed.

OS command injection in Ruijie RG-EW1800GX PRO (and related RG-EW1800GX / RG-EW300N) router firmware lets an attacker who already holds valid low-privilege credentials execute arbitrary OS commands on the device by sending a crafted POST request to the module_get handler backed by /usr/local/lua/dev_sta/networkConnect.lua. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, exploitation is remote but gated on authenticated access - on these consumer/SOHO routers the management panel is normally LAN-only, so WAN exploitation depends on remote administration being enabled or the panel being internet-exposed. Publicly available exploit code exists (a GitHub PoC writeup plus OneDrive payload links), and EPSS sits at ~2.64% (85th percentile), indicating elevated but not top-tier predicted exploitation; it is not a confirmed actively exploited (CISA KEV) issue.

OS command injection in Ruijie X60 PRO firmware (V1.00/V2.00, build X60_10212014RG) lets an authenticated remote attacker who can reach the device's HTTP management interface execute arbitrary operating-system commands by sending a crafted POST request to the module_set operation handled by /usr/local/lua/dev_config/config_retain.lua. The vulnerability requires valid credentials (CVSS PR:L, network reachable, no user interaction), so practical exposure is concentrated on devices whose admin interface is exposed to untrusted networks or left on weak/default logins. Publicly available exploit code exists and EPSS sits at roughly 2.64% (85th percentile), indicating moderately elevated but not uniformly high exploitation risk; no CISA KEV confirmation of active exploitation was present in the available data.

Authenticated OS command injection in Ruijie X60 PRO router firmware (V1.00/V2.00, build 1.021.2014) allows an attacker holding low-privilege credentials to run arbitrary system commands via a crafted POST request to the module_set function in /usr/local/lua/dev_sta/nbr_cwmp.lua, yielding full compromise of confidentiality, integrity, and availability (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The same flaw is reported against Ruijie RG-EW3200GX firmware 3.0(1)b11p219. Publicly available exploit code exists (including a GitHub write-up and hosted PoC artifacts), and EPSS places the CVE at roughly 2.57% (85th percentile), so it is a realistically attractive target for exploitation once an attacker can reach the management interface, though it requires at least low-level authentication and is not confirmed as actively exploited (no CISA KEV listing).

Authenticated OS command injection in the Ruijie X30-PRO (and RG-EST310) firmware allows a low-privileged user to execute arbitrary commands on the device by sending a single crafted POST request to the 'module_set' operation handled by /usr/local/lua/dev_sta/nbr_cwmp.lua. According to the CVSS vector (AV:N/AC:L/PR:L/UI:N), exploitation is remote, low complexity, and requires only valid low-level credentials against the management service, with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists, and the EPSS score of 3.05% (87th percentile) indicates elevated relative risk, though there is no confirmation of active exploitation.

OS command injection in Ruijie M18 EW and RG-EW1300G router firmware allows a remote attacker holding a valid low-privilege management session (CVSS PR:L) to run arbitrary OS commands as the device through a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua. The assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) and the independent assessment agree that exploitation is conditional rather than fully unauthenticated: the attacker must first reach the web/management interface and obtain credentials or a session, with exposure highest where remote administration is enabled. Publicly available exploit code exists (a GitHub proof-of-concept/advisory repository), but there is no CISA KEV listing confirming active exploitation, and EPSS is 2.57% (85th percentile), indicating a credible but conditional priority.

Authenticated OS command injection in Ruijie Reyee OS firmware for wireless bridges and access points - including the RG-YST250F, RG-EST310 V2, RG-EAP602 and related RG-YST/EST series devices running Reyee OS 219/221 builds - allows a low-privilege user who can reach the LuCI web management interface to execute arbitrary shell commands on the device by sending a crafted POST request that abuses the pwdmodify function in /usr/lib/lua/luci/modules/common.lua. Because the injected command runs with the privileges of the web server backend (typically root on these embedded platforms), a successful attacker gains full control of the device's confidentiality, integrity and availability, consistent with the assessed CVSS:3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no CISA KEV listing confirming active exploitation and EPSS is modest at 1.66% (76th percentile), but a public GitHub advisory repository documents the flaw along with reproduction detail, so the issue should be treated as a credible mid-tier priority rather than a critical fire-drill - most urgent for operators who have left the management interface reachable from untrusted networks or who still permit default or weak administrative credentials.

OS command injection in the Ruijie RG-BCR860 router firmware (build 2.5.13-r2224) lets attackers with a valid low-privilege session on the web management interface execute arbitrary OS commands on the device by sending a crafted POST request to the network_set_wan_conf endpoint. The flaw resides in the LuCI controller file /usr/lib/lua/luci/controller/admin/netport.lua and carries a CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning authentication is required but no user interaction is needed. Publicly available exploit code exists (EPSS 3.05%, percentile 87%), but there is no CISA KEV confirmation of active exploitation at time of analysis; the practical risk is highest where the router's management interface is exposed beyond a trusted LAN segment.

Authenticated attackers with low-privilege access can execute arbitrary OS commands on Ruijie RG-BCR860 routers by sending a crafted POST request to the action_deal_update endpoint in the LuCI-based web management interface. Exploitation requires network reachability to the management API and valid credentials, but publicly available exploit code exists, and the EPSS score of 3.05% (87th percentile) indicates a moderate likelihood of exploitation. No vendor-released patch has been identified at time of analysis.

OS command injection in Ruijie RG-BCR860 firmware allows authenticated attackers with network access to the LuCI web management interface to execute arbitrary OS commands on the device via a crafted POST request to the action_wireless handler in /usr/lib/lua/luci/control/admin/wireless.lua. The flaw is tracked as CVE-2025-56109 and carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it requires valid low-privilege credentials and no user interaction but yields high confidentiality, integrity, and availability impact. EPSS is 3.05% (87th percentile) and publicly available exploit code exists, though there is no confirmation of active exploitation (not in CISA KEV); this is a genuine but not top-tier emergency priority.

Authenticated OS command injection in Ruijie X30-PRO wireless routers and related Ruijie wireless firmware (RG-EAP602, RG-EST350, RG-EW300 PRO, RG-EST310) allows a low-privileged, logged-in user to execute arbitrary system commands by sending a crafted POST request to the pwdmodify handler implemented in /usr/lib/lua/luci/modules/common.lua. The issue is rated CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), and publicly available exploit code exists - including a dedicated GitHub vulnerability report (flegoity) and accompanying proof-of-concept links - while EPSS sits at 2.66% (roughly the 85th percentile), indicating elevated relative likelihood rather than confirmed active exploitation. Risk concentrates on devices whose web management interface is reachable from untrusted networks; LAN-only or firewalled management interfaces substantially reduce exposure.

OS command injection in the Ruijie RG-BCR600W router firmware allows an attacker who holds a low-privilege authenticated session on the web management interface to run arbitrary operating-system commands by sending a crafted POST request to the submit_wifi action handled by /usr/lib/lua/luci/controller/admin/common_quick_config.lua. Successful exploitation yields full compromise of confidentiality, integrity, and availability of the device (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the practical risk is highest where the admin panel is reachable from the internet or an untrusted LAN segment and where default or weak credentials remain in place. EPSS sits at roughly 2.25% (83rd percentile), indicating elevated relative attention but not a mass-exploitation event, and no public exploit identified at time of analysis; this is a credible above-average priority for operators of the affected hardware rather than an emergency.

Authenticated OS command injection in Ruijie RG-EW1800GX firmware build B11P226_EW1800GX_10223121 (and, per CPE data, the RG-EST350 build 3.0(1)B11P221) lets remote attackers who already hold a low-privilege session execute arbitrary shell commands on the device by sending a crafted POST request to the module_set endpoint handled by /usr/local/lua/dev_sta/nbr_cwmp.lua, resulting in high confidentiality, integrity and availability impact. Publicly available exploit code exists (posted exploit references and a vendor-adjacent GitHub write-up), and EPSS rates the issue at 2.76% (86th percentile), but there is no CISA KEV confirmation of active exploitation. Our assessment classifies this as a credible, elevated-priority issue requiring remediation, but not a top-tier emergency, since the attacker must first reach the management plane with valid low-privilege credentials.

Authenticated OS command injection in Ruijie RG-EW1800GX (firmware B11P226) and RG-EW300R (firmware B11P301) routers lets an attacker who already holds credentials on the device execute arbitrary shell commands by sending a crafted POST request to the module_get action handled by /usr/local/lua/dev_sta/networkConnect.lua. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) confirms network reachability and low attack complexity but requires some form of authentication (PR:L), which is the main practical barrier; publicly available exploit code exists (no CISA KEV listing, so active exploitation is not confirmed), and EPSS sits at 2.57% (85th percentile), indicating a modest but above-average likelihood of exploitation relative to the wider CVE population. Devices with a WAN-exposed management interface, remote management enabled, or weak/default admin credentials are materially more exposed than LAN-only, strongly-authenticated deployments.

Authenticated OS command injection in Ruijie M18 (EW 3.0(1)B11P226) and RG-EW1200R (EW_3.0(1)B11P301) router firmware lets a remote attacker with low-privilege credentials execute arbitrary commands on the device by sending a crafted POST request to the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua. Publicly available exploit code exists (a GitHub vulnerability report with technical details), though there is no CISA KEV confirmation of active exploitation; EPSS estimates a 2.76% chance of exploitation within 30 days (86th percentile). Exploitation requires network reachability to the router's web management interface and valid low-privilege credentials, but default or weak SOHO router passwords may lower that barrier, making this a credible moderately-high priority issue.

OS command injection in Ruijie wireless access point firmware based on Reyee OS - including RG-YST250F, RG-EST310 v2 and RG-EAP602 builds - lets an authenticated attacker with low-privilege management credentials execute arbitrary operating-system commands on the device via a crafted POST request to the pwdmodify handler in /usr/lib/lua/luci/modules/common.lua. The flaw rates CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), and EPSS is 1.66% (~76th percentile), indicating meaningful but not top-tier exploitation likelihood; no public exploit code or confirmed actively exploited status (CISA KEV) was identified at time of analysis. Practical risk depends heavily on whether the web management interface is exposed beyond a trusted admin VLAN, since valid credentials are a prerequisite.

OS command injection in Ruijie X30-PRO (firmware X30-PRO-V1_09241521) and Ruijie RG-EW300 Pro (firmware 3.0(1)b11p219) allows a low-privilege authenticated attacker to execute arbitrary OS commands via a crafted POST request to the module_get function in /usr/local/lua/dev_sta/networkConnect.lua. Publicly available exploit code exists, and the EPSS score is 2.57% (85th percentile), indicating a moderate likelihood of exploitation, though no active exploitation has been confirmed (not listed in CISA KEV). The vulnerability is remotely exploitable with low complexity but requires valid credentials to the device's web management interface.

Authenticated OS command injection in Ruijie RG-EW1800GX PRO (firmware 3.0(1)B11P226) and RG-EW300N (firmware 3.0(1)B11P300) routers allows an attacker holding a valid low-privilege management session to execute arbitrary shell commands on the device by sending a crafted POST request to the module_set handler. Because the injected commands run with the privileges of the router's web/config service, a successful exploit yields full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), enabling configuration tampering, credential theft, traffic interception, and potential use of the device as a pivot into the LAN. Publicly available exploit code exists (including a detailed write-up and proof-of-concept hosted on OneDrive and GitHub), and EPSS sits at 2.57% (85th percentile), so exploitation is feasible for anyone who can authenticate to the management interface, though reachability of that interface (typically LAN-facing unless remote administration is enabled) and the requirement for valid credentials remain the main gates.

Authenticated OS command injection in the Ruijie RG-BCR600W router firmware allows a logged-in, low-privilege user to run arbitrary shell commands on the device by sending a crafted POST request to the restart_modules action implemented in /usr/lib/lua/luci/controller/admin/common.lua. The issue is rated CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and classified CWE-78, with EPSS at 1.98% (~80th percentile) indicating a modest but non-trivial likelihood of exploitation attempts in the wild. Exploitation is not pre-authentication: attackers must first reach the web management interface and hold valid low-privilege credentials, so exposure hinges on whether the device's admin plane is reachable from untrusted networks; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.

Authenticated OS command injection in Ruijie RG-EW1200G PRO routers running firmware V1.00, V2.00, V3.00 or V4.00 lets a remote attacker with low-privilege credentials execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set action handled in /usr/local/lua/dev_sta/nbr_cwmp.lua. Publicly available exploit code exists (a GitHub vulnerability report plus linked OneDrive proof-of-concept artifacts), and EPSS rates the flaw at 2.76% (86th percentile), but it is not listed in CISA KEV, so active exploitation is not confirmed. Because the CVSS vector is AV:N/PR:L/UI:N with high C/I/A impact, the attacker must first reach the router's management interface and hold valid (even low-level) credentials, meaning LAN-restricted management and strong unique credentials materially reduce exposure.

Authenticated command injection in Ruijie X30-PRO and RG-EW300 PRO router firmware allows an attacker with low-privileged credentials to execute arbitrary OS commands via a crafted POST request to the module_get function in /usr/local/lua/dev_sta/host_access_delay.lua. Publicly available exploit code exists, and the EPSS score of 3.27% (88th percentile) indicates a moderate likelihood of exploitation attempts. The vulnerability requires network access to the device management interface and valid credentials, limiting realistic risk to exposed management interfaces or LAN-side attackers.

OS command injection in Ruijie X30-PRO firmware (build X30-PRO-V1_09241521) and related RG-EW300 PRO and RG-EAP602 builds allows an authenticated, low-privilege attacker who can reach the LuCI web management interface to execute arbitrary OS commands through a crafted POST request to the setWisp endpoint handled by /usr/lib/lua/luci/modules/wireless.lua. Publicly available exploit code exists, and EPSS rates the issue at 3.15% (88th percentile), though CISA KEV does not list it as confirmed actively exploited. Successful exploitation yields full confidentiality, integrity, and availability impact on the device (CVSS 8.8), and the practical risk is amplified because SOHO/SMB devices frequently ship with default or weak credentials and may expose management over LAN or WAN.

Authenticated OS command injection in Ruijie X30 Pro (firmware X30-PRO-V1_09241521) and RG-EW300T router firmware lets an attacker with a valid management session execute arbitrary OS commands on the device via a crafted POST request to the module_get handler. Publicly available exploit code exists, though there is no evidence of confirmed active exploitation (no CISA KEV listing). EPSS is 2.76% (86th percentile), suggesting elevated but not mass-exploitation risk; the CVSS vector indicates at least low-privileged authentication (PR:L) is required and user interaction is not.

OS command injection in the Ruijie RG-EW1800GX and RG-EW300R router firmware allows an authenticated attacker to execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set handler backed by /usr/local/lua/dev_config/config_retain.lua. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N), exploitation is remote, low-complexity, and requires only low-privilege authentication, so the primary barrier is obtaining valid low-level credentials or abusing weak/default logins; no user interaction is needed. Publicly available exploit code exists and the vulnerability is detailed in a public GitHub advisory, but there is no confirmation that it is being actively exploited (not listed on CISA KEV); EPSS is 2.91% (87th percentile), indicating elevated relative likelihood of exploitation activity. The risk profile is a credible, actionable priority but not a drop-everything emergency.

Authenticated OS command injection in Ruijie RG-EW1200G PRO wireless routers (firmware V1.00, V2.00, V3.00 and V4.00) allows a low-privileged user of the device management interface to execute arbitrary operating-system commands through a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua, yielding high confidentiality, integrity and availability impact (CVSS 8.8). Per the assessed vector (AV:N/AC:L/PR:L/UI:N), the attacker must first reach the management interface and hold at least low-level authenticated access, which is the primary limiting factor; no user interaction is required and attack complexity is low. Publicly available exploit code exists (a dedicated GitHub proof-of-concept write-up plus mirrored exploit artifacts), and EPSS is 2.91% (87th percentile), indicating elevated but not top-tier predicted exploitation likelihood; there is no CISA KEV entry confirming active exploitation, and no vendor-released patch has been identified at time of analysis.

Authenticated OS command injection in Ruijie M18 EW_3.0(1)B11P226 firmware (with the same code path in RG-EW300G Pro EW_3.0(1)B11P219) lets a low-privileged authenticated attacker execute arbitrary shell commands on the device by sending a crafted POST request to the module_set function in /usr/local/lua/dev_sta/nbr_cwmp.lua. Exploitation requires network reachability to the device management interface plus valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N, score 8.8), and no user interaction is needed. Publicly available exploit code exists and the EPSS score is 2.84% (86th percentile), so risk is real but this is a credible, not top-tier emergency, priority - exposure drops sharply for devices whose management UI is not reachable from untrusted networks.

OS command injection in Ruijie RG-BCR860 firmware lets an authenticated remote attacker execute arbitrary commands on the device by sending a crafted POST request to the action_service action handled in /usr/lib/lua/luci/controller/admin/service.lua. The CVSS 3.1 vector (8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) shows the attacker must already hold low-privilege credentials for the LuCI management interface, so risk concentrates on gateways with weak, default, or shared admin passwords or with the management web service exposed to untrusted networks. Publicly available exploit code exists and EPSS is 3.46% (89th percentile); there is no CISA KEV listing, so this is not confirmed active exploitation.

Authenticated command injection in Ruijie RG-BCR600W firmware allows low-privileged users to execute arbitrary OS commands by sending a crafted POST request to the run_tcpdump action in the LuCI web interface. Exploitation requires network access to the device's management interface and a valid low-privilege session (CVSS PR:L), with risk magnified by default or weak credentials. EPSS is 2.44% (84th percentile), indicating elevated but not critical risk; no active exploitation in CISA KEV and no public exploit code identified at time of analysis.

Authenticated OS command injection in Ruijie RG-EW1200 (firmware 3.0(1)B11P227) and RG-X60 (firmware 3.0(1)B11P237) routers lets a network-reachable attacker who already holds low-privilege credentials run arbitrary commands on the device by sending a crafted POST request to the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua. Publicly available exploit code exists and the EPSS score is 2.91% (87th percentile), but there is no confirmed active exploitation (the CVE is not in CISA KEV). Impact per the assessed vector is high - full loss of confidentiality, integrity, and availability on the affected device - yet exploitation first requires valid credentials or a session, so this is a credible mid-tier priority rather than an emergency.

Command injection in Ruijie RG-EW1200 and RG-EW300 Pro router firmware lets authenticated network attackers execute arbitrary operating system commands through a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua. The vulnerable builds are RG-EW1200 firmware 3.0(1)B11P227 and RG-EW300 Pro firmware 3.0(1)B11P219, and exploitation requires network reachability to the web/management interface plus low-privilege credentials (CVSS PR:L). Publicly available exploit code exists, and EPSS is 2.92% (87th percentile), but there is no CISA KEV entry confirming active exploitation; the independent assessment rates this as elevated-priority for affected SOHO router operators rather than an internet-wide emergency.

Authenticated command injection in Ruijie Reyee OS (and the affected RG-EW1800GX PRO, RG-EAP602, RG-EST310 V2 and RG-YST250F firmware builds) lets a low-privileged user who can reach the device's HTTP management interface execute arbitrary OS commands by sending a crafted POST request to the module_set handler backed by /usr/local/lua/dev_sta/nbr_cwmp.lua. Because the vulnerable path is part of the CWMP/TR-069 remote-management module, exposure is concentrated in devices with that service enabled; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C/I/A:H) scores 8.8, reflecting full compromise of confidentiality, integrity and availability once valid credentials are supplied. Exploitation requires network reachability and valid low-privilege authentication rather than being unauthenticated, and reports point to a public technical write-up of the flaw; EPSS is 2.05% (81st percentile), indicating moderate but not top-tier predicted exploitation activity, and no public exploit code has been identified at time of analysis.

OS command injection in Ruijie X30-PRO (firmware X30-PRO-V1_09241521) and related Reyee OS-based Ruijie devices allows an authenticated low-privilege user to execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set parameter processed by /usr/local/lua/dev_sta/nbr_networkId_merge.lua. The issue carries a CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and EPSS of 2.00% (80th percentile), indicating a real but currently modest level of exploitation interest; no CISA KEV listing is present and no public exploit code was identified at time of analysis, so this is a serious but not top-tier emergency. The practical barrier is the required authenticated session on the web/management interface, which means unauthenticated internet-wide exploitation is not indicated.

Authenticated OS command injection in the Ruijie RG-BCR600W branch/SOHO router allows a remote attacker who already holds valid management credentials to execute arbitrary operating-system commands on the device by sending a crafted POST request to the check_changes action handled by /usr/lib/lua/luci/controller/admin/common.lua. Successful exploitation yields full compromise of confidentiality, integrity and availability of the router (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). The attack is not viable against devices whose LuCI web management interface is unreachable or protected by strong credentials, but risk rises sharply where the UI is exposed to untrusted networks or still uses default/weak logins; EPSS is 2.38% (84th percentile) and no public exploit code has been identified at time of analysis, with no CISA KEV listing.