Authenticated command execution via unsanitized province parameter

Command injection in Ruijie NBR800G RGOS 11.1(6)B4P9 allows remote authenticated users to execute OS commands via province. The /itbox_pi/networksafe.php handler inserts the controllable province value into an exec command without neutralizing shell metacharacters. The published proof uses an administrator session cookie and shell redirection to write command output into a web-accessible PHP file; the disclosure also reports that exploitation can crash the gateway.