PT-2025-50657

Name of the Vulnerable Software and Affected Versions Ruijie RG-BCR RG-BCR600W affected versions not specified Description An issue exists in Ruijie RG-BCR RG-BCR600W that allows attackers to execute arbitrary commands. This is possible through a crafted POST request to the run tcpdump function...

CVE-2025-56088

CVE-2025-56088 affects Ruijie RG-BCR RG-BCR860. The vulnerability is an OS command injection caused by unvalidated input in the action_service endpoint at /usr/lib/lua/luci/controller/admin/service.lua, exploitable via a crafted POST request. Impact as described: arbitrary command execution with ...

CVE-2025-56108

CVE-2025-56108 affects Ruijie X30-PRO (X30-PRO-V1_09241521). An OS command injection via a crafted POST to /usr/lib/lua/luci/modules/common.lua pwdmodify allows arbitrary command execution. Root cause: improper handling in the pwdmodify function. Impact: high (remote command execution with networ...

CVE-2025-56107

CVE-2025-56107 affects Ruijie RG-BCR RG-BCR600W. A OS Command Injection exists in the submit_wifi function accessed via a crafted POST to /usr/lib/lua/luci/controller/admin/common_quick_config.lua. CVSSv3.1 base score 8.8 (HIGH) with network exposure, low attack complexity, and no user interactio...

CVE-2025-56098

Summary of CVE-2025-56098 : Affected device is Ruijie X30-PRO (X30-PRO-V1_09241521). The vulnerability is an OS Command Injection in the Lua module handler at /usr/local/lua/dev_sta/networkConnect.lua, exploitable via a crafted POST request to the module_get endpoint. This is triggered by unvalid...

CVE-2025-56127

The CVE-2025-56127 entry concerns Ruijie RG-BCR RG-BCR600W. The vulnerability is an OS Command Injection in the get_wanobj handler inside /usr/lib/lua/luci/controller/admin/common.lua, triggered by a crafted POST request. The root cause is improper handling of crafted input, enabling execution of...

CVE-2025-56097

Summary: CVE-2025-56097 is an OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO (B11P226_EW1800GX-PRO_10223117). An attacker can inject and execute arbitrary commands by issuing a crafted POST request to the module_set function in the file /usr/local/lua/dev_config/config_retain.lua. A...

CVE-2025-56093

CVE-2025-56093 affects Ruijie X30-PRO (X30-PRO-V1_09241521). The vulnerability is an OS command injection in the wireless.lua module (path: /usr/lib/lua/luci/modules/wireless.lua) that can be triggered by a crafted POST request to setWisp. Root cause is unvalidated input leading to arbitrary comm...

CVE-2025-56085

CVE-2025-56085 affects Ruijie RG-EW1200 devices running EW 3.0(1)B11P227 EW1200 11130208RG-EW1200 V1.00. The flaw is an OS command injection in the module_set handler triggered by a crafted POST to /usr/local/lua/dev_config/config_retain.lua, stemming from unvalidated input. This can allow an att...

EUVD-2025-202746

OS Command Injection vulnerability in Ruijie RG-EW1200 EW3.01B11P227EW120011130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devconfig/configretain.lua...

CVE-2025-56090

OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devconfig/configretain.lua...

TrippLite SU2200RTXL2Ua Improper Neutralization of Input During Web Page Generation (CVE-2020-26801)

A stored cross-site scripting XSS vulnerability was discovered in /Forms/devicevars1 on TrippLite SU2200RTXL2Ua with firmware version 12.04.0055. This vulnerability allows authenticated attackers to obtain other users' information via a crafted POST request. This plugin only works with Tenable.ot...

EUVD-2025-202747

OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226EW1800GX-PRO10223117 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devsta/nbrcwmp.lua...

CVE-2025-56083

OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V109241521 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devsta/nbrnetworkIdmerge.lua...

PT-2025-50661

Name of the Vulnerable Software and Affected Versions Ruijie RG-EW1800GX version B11P226 EW1800GX 10223121 Description An issue exists in Ruijie RG-EW1800GX version B11P226 EW1800GX 10223121 that allows attackers to execute arbitrary commands. This is possible through a crafted POST request to th...

PT-2025-50683

Name of the Vulnerable Software and Affected Versions Ruijie X30-PRO version X30-PRO-V1 09241521 Description An issue exists in Ruijie X30-PRO version X30-PRO-V1 09241521 that allows attackers to execute arbitrary commands. This is possible through a crafted POST request to the module set paramet...

CVE-2025-56107

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the submitwifi in file /usr/lib/lua/luci/controller/admin/commonquickconfig.lua...

PT-2025-50687

Name of the Vulnerable Software and Affected Versions Ruijie RG-EW1200G PRO versions 1.00 through 4.00 Description An OS Command Injection issue exists in Ruijie RG-EW1200G PRO. Attackers can execute arbitrary commands by sending a specially crafted POST request to the module get function within...

CVE-2025-56130

OS Command Injection vulnerability in Ruijie RG-S1930 S1930SWITCH3.01B11P230 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleupdate in file /usr/local/lua/devconfig/acesw.lua...

CVE-2025-56129

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the actiondiagnosis in file /usr/lib/lua/luci/controller/admin/diagnosis.lua...