Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-65363 | 7.2 high | 7.0% | ruijie, rg-ap720-l_firmware | Authenticated append-style command-injection Ruijie APs (AP_RGOS 11.1.x) allows an authenticated web user to execute appended shell expressions as root, enabling file disclosure, device disruption, and potential network pivoting via the command parameter to the web_action.do endpoint. | 18 Oct |
| CVE-2025-11141 | 2.0 low | 4.0% | no CPE yet | A security flaw has been discovered in Ruijie NBR2100G-E up to 20250919. Affected by this issue is the function listAction of the file /itbox_pi/branch_passw.php?a=list. Performing manipulation of the argument city results in os command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way. | 9 Oct |
| CVE-2025-56077 | 8.8 high | 3.0% | ruijienetworks, ruijie, reyee_os, rg-rap2200\(e\)_firmware | OS Command Injection vulnerability in Ruijie RG-RAP2200(E) 247 2200 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua. | 14 Oct |
| CVE-2025-56085 | 8.8 high | 3.0% | ruijie, rg-ew1200_firmware, rg-ew300_pro_firmware | OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua. | 14 Oct |
| CVE-2025-56086 | 8.8 high | 3.0% | ruijie, rg-ew1200_firmware, rg-x60_firmware | OS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua. | 14 Oct |
| CVE-2025-56088 | 8.8 high | 3.0% | ruijie, rg-bcr860_firmware | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_service in file /usr/lib/lua/luci/controller/admin/service.lua. | 14 Oct |
| CVE-2025-56089 | 8.8 high | 3.0% | ruijie, m18-ew_firmware, rg-ew300g_pro_firmware | OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua. | 14 Oct |
| CVE-2025-56091 | 8.8 high | 3.0% | ruijie, rg-ew1800gx_firmware, rg-ew300r_firmware | OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua. | 14 Oct |
| CVE-2025-56093 | 8.8 high | 3.0% | ruijie, x30_pro_firmware, rg-ew300_pro_firmware, rg-eap602_firmware | OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the setWisp in file /usr/lib/lua/luci/modules/wireless.lua. | 14 Oct |
| CVE-2025-56094 | 8.8 high | 3.0% | ruijie, x30_pro_firmware, rg-ew300_pro_firmware | OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/host_access_delay.lua. | 14 Oct |
| CVE-2025-56097 | 8.8 high | 3.0% | ruijie, rg-ew1800gx_pro_firmware, rg-ew300n_firmware | OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua. | 14 Oct |
| CVE-2025-56098 | 8.8 high | 3.0% | ruijie, x30_pro_firmware, rg-ew300_pro_firmware | OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua. | 14 Oct |
| CVE-2025-56101 | 8.8 high | 3.0% | ruijie, m18-ew_firmware, rg-ew1200r_firmware | OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua. | 14 Oct |
| CVE-2025-56102 | 8.8 high | 3.0% | ruijie, rg-ew1800gx_firmware, rg-ew300r_firmware | OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua. | 14 Oct |
| CVE-2025-56106 | 8.8 high | 3.0% | ruijie, rg-ew1800gx_firmware, rg-est350_firmware | OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua. | 14 Oct |
| CVE-2025-56108 | 8.8 high | 3.0% | ruijie, x30_pro_firmware, rg-eap602_firmware, rg-est350_firmware | OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua. | 14 Oct |
| CVE-2025-56109 | 8.8 high | 3.0% | ruijie, rg-bcr860_firmware | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_wireless in file /usr/lib/lua/luci/control/admin/wireless.lua. | 14 Oct |
| CVE-2025-56110 | 8.8 high | 3.0% | ruijie, rg-bcr860_firmware | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_deal_update in file /usr/lib/lua/luci/controller/api/rcmsAPI.lua. | 14 Oct |
| CVE-2025-56111 | 8.8 high | 3.0% | ruijie, rg-bcr860_firmware | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the network_set_wan_conf in file /usr/lib/lua/luci/controller/admin/netport.lua. | 14 Oct |
| CVE-2025-56114 | 8.8 high | 3.0% | ruijie, rg-ew1300g_firmware, m18-ew_firmware | OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua. | 14 Oct |
| CVE-2025-56117 | 8.8 high | 3.0% | ruijie, x30_pro_firmware, rg-est310_firmware | OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua. | 14 Oct |
| CVE-2025-56118 | 8.8 high | 3.0% | ruijie, rg-ew3200gx_firmware, rg-x60_pro_firmware | OS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua. | 14 Oct |
| CVE-2025-56120 | 8.8 high | 3.0% | ruijie, rg-x60_pro_firmware, rg-ew1200_firmware | OS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua. | 14 Oct |
| CVE-2025-56122 | 8.8 high | 3.0% | ruijie, rg-ew1800gx_firmware, rg-ew300n_firmware, rg-ew1800gx_pro_firmware | OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua. | 14 Oct |
| CVE-2025-56127 | 8.8 high | 3.0% | ruijie, rg-bcr600w_firmware | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the get_wanobj in file /usr/lib/lua/luci/controller/admin/common.lua. | 14 Oct |
| CVE-2025-56129 | 8.8 high | 3.0% | ruijie, rg-bcr860_firmware | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_diagnosis in file /usr/lib/lua/luci/controller/admin/diagnosis.lua. | 14 Oct |
| CVE-2025-56082 | 8.8 high | 2.0% | ruijie, rg-bcr600w_firmware | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the check_changes in file /usr/lib/lua/luci/controller/admin/common.lua. | 14 Oct |
| CVE-2025-56083 | 8.8 high | 2.0% | ruijie, rg-yst250f_firmware, rg-est310_v2_firmware, reyee_os | OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_networkId_merge.lua. | 14 Oct |
| CVE-2025-56084 | 8.8 high | 2.0% | ruijie, rg-yst250f_firmware, rg-est310_v2_firmware, reyee_os | OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226_EW1800GX-PRO_10223117 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua. | 14 Oct |
| CVE-2025-56087 | 8.8 high | 2.0% | ruijie, rg-bcr600w_firmware | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the run_tcpdump in file /usr/lib/lua/luci/controller/admin/common_tcpdump.lua. | 14 Oct |
| CVE-2025-56096 | 8.8 high | 2.0% | ruijie, rg-bcr600w_firmware | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the restart_modules in file /usr/lib/lua/luci/controller/admin/common.lua. | 14 Oct |
| CVE-2025-56099 | 8.8 high | 2.0% | ruijie, rg-yst250f_firmware, rg-est310_v2_firmware, reyee_os | OS Command Injection vulnerability in Ruijie RG-YST AP_3.0(1)B11P280YST250F allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua. | 14 Oct |
| CVE-2025-56107 | 8.8 high | 2.0% | ruijie, rg-bcr600w_firmware | OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the submit_wifi in file /usr/lib/lua/luci/controller/admin/common_quick_config.lua. | 14 Oct |
| CVE-2025-56113 | 8.8 high | 2.0% | ruijie, rg-yst250f_firmware, rg-est310_v2_firmware, reyee_os | OS Command Injection vulnerability in Ruijie RG-YST EST, YSTAP_3.0(1)B11P280YST250F V1.xxV2.xx allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua. | 14 Oct |
| CVE-2025-56130 | 8.8 high | 2.0% | ruijie, rg-nbs5100-24gt4sfp_firmware, rg-s1930_firmware | OS Command Injection vulnerability in Ruijie RG-S1930 S1930SWITCH_3.0(1)B11P230 allowing attackers to execute arbitrary commands via a crafted POST request to the module_update in file /usr/local/lua/dev_config/ace_sw.lua. | 14 Oct |
| CVE-2025-58778 | 8.6 high | 1.0% | no CPE yet | Multiple versions of RG-EST300 provided by Ruijie Networks provide SSH server functionality. It is not documented in the manual, and enabled in the initial configuration. Anyone with the knowledge of the related credentials can log in to the affected device, leading to information disclosure, altering the system configurations, or causing a denial of service (DoS) condition. | 8 Oct |
| CVE-2025-56124 | 7.8 high | 1.0% | ruijie, rg-x60_pro_firmware, rg-ew1200_firmware | OS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua. | 14 Oct |
| CVE-2026-14736 | 5.5 medium | 0.00% | no CPE yet | A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted element is an unknown function of the file user_auth_commit.php. Performing a manipulation of the argument upload_image results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. | Sun 25 Oct |
38 of 38
Download these 38 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.