CRITICAL SECURITY & PRIVACY VULNERABILITY: Lack of PPPoE Intra-Client Isolation on RG-EG1510XS (ReyeeOS)

Dear Ruijie Engineering & Product Development Team,
​I am writing to formally report a critical architectural security defect in the ReyeeOS firmware running on the RG-EG1510XS gateway.
​Currently, the platform lacks L3 ACLs on Virtual-Templates and does not support intra-PPPoE client isolation. As a result, PPPoE subscribers within the same pool can freely scan, access, and attempt to log into other subscribers' ONT/ONU web interfaces.
​Legal & Regulatory Compliance Implication:
Under personal data protection laws and telecommunications privacy regulations, allowing unauthorized cross-client access to subscriber premises equipment (CPE) constitutes a severe data privacy breach and security hazard. As an ISP operator, using hardware with unmitigated peer-to-peer exposure puts us at immediate risk of regulatory non-compliance and legal liability.
​Required Urgent Action:
A gateway designed for PPPoE deployment must enforce client isolation at the Virtual-Template level. We strongly urge your software development team to treat this as an urgent Security Vulnerability and release a firmware update implementing:
​Intra-PPPoE pool traffic isolation (blocking peer-to-peer communication between PPPoE clients).
​Virtual-Template ACL capability to drop unauthorized cross-subnet/gateway access.
​We expect this critical flaw to be escalated immediately to your core development team for a permanent patch.
​Sincerely,
DIL-NET.ID Network Engineering Team