Ruijie vulnerabilities
Published CVEs affecting Ruijie products: 46 record(s), with severity, exploitation and fixes.
Rg-eap602 Firmware 7X30 Pro Firmware 6Rg-bcr860 Firmware 5Rg-ew300 Pro Firmware 5Reyee Os 5Rg-bcr600w Firmware 5Rg-yst250f Firmware 4Rg-ew1800gx Firmware 4Rg-ew1200 Firmware 4Rg-est310 V2 Firmware 4Rg-x60 Pro Firmware 3Rg-ew1200g Pro Firmware 3M18-ew Firmware 3Rg-ew1300g Firmware 3RG-EW3000GX 2Rg-ew300n Firmware 2Rg-est350 Firmware 2Rg-est310 Firmware 2Rg-ew1800gx Pro Firmware 2Rg-ew300r Firmware 2Rg-ew1200r Firmware 2Rg-ew300g Pro Firmware 1Rg-x60 Firmware 1Rg-rap2200(e) Firmware 1Rg-ap720-l Firmware 1Rg-ew300t Firmware 1Rg-ew3200gx Firmware 1Rg-nbs5100-24gt4sfp Firmware 1Rg-s1930 Firmware 1EG105G-P 1NBR2100G-E 1RG-UAC 1Be50 Firmware 1
CVE-2025-56098
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to...
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
CVE-2025-56097
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117...
OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
CVE-2025-56096
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute...
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the restart_modules in file /usr/lib/lua/luci/controller/admin/common.lua.
CVE-2025-56094
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to...
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/host_access_delay.lua.
CVE-2025-56093
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to...
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the setWisp in file /usr/lib/lua/luci/modules/wireless.lua.
CVE-2025-56095
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection in Ruijie Rg-ew1200g Pro Firmware
OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.
CVE-2025-56092
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection in Ruijie Rg-ew300t Firmware
OS Command Injection vulnerability in Ruijie X30 PRO V1 X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
CVE-2025-56091
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing...
OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
CVE-2025-56089
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers...
OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.
CVE-2025-56090
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection in Ruijie Rg-ew1200g Pro Firmware
OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
CVE-2025-56088
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute...
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_service in file /usr/lib/lua/luci/controller/admin/service.lua.
CVE-2025-56087
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute...
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the run_tcpdump in file /usr/lib/lua/luci/controller/admin/common_tcpdump.lua.
CVE-2025-56086
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200...
OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
CVE-2025-56085
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200...
OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
CVE-2025-56084
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117...
OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.
CVE-2025-56083
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to...
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_networkId_merge.lua.
CVE-2025-56082
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection in Ruijie Rg-bcr600w Firmware
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the check_changes in file /usr/lib/lua/luci/controller/admin/common.lua.
CVE-2025-56077
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection vulnerability in Ruijie RG-RAP2200(E) 247 2200 allowing attackers to execute...
OS Command Injection vulnerability in Ruijie RG-RAP2200(E) 247 2200 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.
CVE-2025-56079
High · 8.8
CWE-78 Dec 11, 2025
OS Command Injection in Ruijie Rg-ew1300g Firmware
OS Command Injection vulnerability in Ruijie RG-EW1300G EW1300G V1.00/V2.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
CVE-2025-65363
High · 7.2
CWE-77 Dec 8, 2025
Authenticated append-style command-injection Ruijie APs (AP_RGOS 11.1.x) allows an authenticated...
Authenticated append-style command-injection Ruijie APs (AP_RGOS 11.1.x) allows an authenticated web user to execute appended shell expressions as root, enabling file disclosure, device disruption, and potential network pivoting via the command parameter to the web_action.do endpoint.
CVE-2025-11141
Medium · 4.7
CWE-77 Sep 29, 2025
Ruijie NBR2100G-E branch_passw.php listAction os command injection
A security flaw has been discovered in Ruijie NBR2100G-E up to 20250919. Affected by this issue is the function listAction of the file /itbox_pi/branch_passw.php?a=list. Performing manipulation of the argument city results in os command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.