---METADATA---
VENDOR: Ruijie
PRODUCT: RG-UAC
AFFECTED_VERSIONS: Ruijie RG-UAC versions up to 1.0-R1.8.2.p5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An unrestricted file upload vulnerability in Ruijie RG-UAC allows remote attackers to upload arbitrary files by manipulating the 'upload_image' argument in 'user_auth_commit.php'.

Executive Summary:
An unrestricted file upload vulnerability in Ruijie RG-UAC permits unauthenticated remote attackers to execute arbitrary code by uploading malicious files to the system.

Vulnerability Details

CVE-ID: CVE-2026-14736

Affected Software: Ruijie RG-UAC

Affected Versions: Ruijie RG-UAC versions up to 1.0-R1.8.2.p5

Vulnerability: The vulnerability resides in the user_auth_commit.php file, which fails to properly validate file types during the upload process. This allows an unauthenticated remote attacker to bypass security controls and upload malicious files via the upload_image argument.

Business Impact

The CVSS score of 7.3 (High) reflects the critical nature of unrestricted file upload vulnerabilities, which often lead to Remote Code Execution (RCE). Successful exploitation could allow an attacker to gain full control over the affected appliance, resulting in complete system compromise and potential lateral movement within the network.

Remediation Plan

Immediate Action: Apply the latest vendor security updates provided by Ruijie. If updates are unavailable, disable the affected file upload functionality if not strictly required for business operations.

Proactive Monitoring: Monitor the filesystem for unexpected executable files or scripts in directories where images or user-submitted content are stored.

Compensating Controls: Utilize a WAF to restrict file upload types and enforce strict access controls on the user_auth_commit.php endpoint.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, the presence of public exploit details significantly lowers the barrier for entry for malicious actors.

Analyst Recommendation

This vulnerability represents a severe risk due to the potential for arbitrary code execution. Organizations using Ruijie RG-UAC must prioritize applying the latest firmware or security patches to mitigate the risk of unauthorized system access.

---METADATA---
VENDOR: Ruijie
PRODUCT: EG105G-P
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw has been discovered in the Ruijie EG105G-P network gateway, potentially compromising device security.

Executive Summary:
A critical security flaw in the Ruijie EG105G-P network gateway exposes the device to potential unauthorized access or control.

Vulnerability Details

CVE-ID: CVE-2026-12197

Affected Software: Ruijie EG105G-P

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw affects the Ruijie EG105G-P gateway. Given the nature of network hardware vulnerabilities, it is likely that this issue could be exploited by remote, unauthenticated attackers to gain unauthorized control over the gateway device.

Business Impact

The CVSS score of 7.2 indicates a high-severity risk. A compromised gateway can serve as a pivot point for attackers to intercept network traffic, launch man-in-the-middle attacks, or gain unauthorized access to the internal network, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Check the Ruijie support website for firmware updates and apply them to all affected EG105G-P units.

Proactive Monitoring: Monitor network traffic for unusual outbound connections or attempts to access the management interface from unauthorized subnets.

Compensating Controls: Restrict access to the device management interface to trusted internal IP addresses and disable unnecessary management services.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 15, 2026, there is no public information indicating active exploitation of this vulnerability. Due to the device's role as a network perimeter gateway, the potential for exploitation is extremely high.

Analyst Recommendation

Urgent action is required to patch this network gateway. Failure to secure the perimeter device could lead to a full compromise of the internal network infrastructure. Ensure all management consoles are isolated from public access.

---METADATA---
VENDOR: Ruijie Networks Co., Ltd.
PRODUCT: AP180 series Wireless AP
AFFECTED_VERSIONS: AP_RGOS 11.9(4)B1P8 and earlier
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://www.ruijie.com.cn/gy/xw-aqtg-gw/930282/","name":null,"tags":[]},{"url":"https://jvn.jp/en/vu/JVNVU94068946/","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:43.010Z
---END_METADATA---

Description Summary:
The Ruijie Networks AP180 series wireless access points contain an OS command injection vulnerability allowing authenticated attackers to execute arbitrary system commands via the CLI service.

Executive Summary:
An OS command injection vulnerability in Ruijie Networks AP180 series access points poses a critical risk by allowing authenticated attackers to execute arbitrary commands on the underlying operating system.

Vulnerability Details

CVE-ID: CVE-2025-68459

Affected Software: Ruijie Networks Co., Ltd. AP180 series Wireless AP

Affected Versions: AP_RGOS 11.9(4)B1P8 and earlier

Vulnerability: This flaw is an OS command injection (CWE-78) vulnerability triggered via the command line interface. It requires the attacker to have high-level administrative access to the CLI service to inject and execute arbitrary system commands.

Business Impact

Successful exploitation allows an attacker to gain full control over the affected wireless access point, potentially leading to unauthorized network configuration changes or the use of the device as a pivot point for internal network attacks. With a CVSS score of 7.2, this vulnerability represents a significant risk to organizational network integrity and operational availability.

Remediation Plan

Immediate Action: Administrators should immediately update affected AP180 devices to a firmware version later than AP_RGOS 11.9(4)B1P8 as prescribed by the vendor advisory.

Proactive Monitoring: Monitor CLI access logs for unusual or unauthorized command strings and audit administrative user activity for suspicious behavior.

Compensating Controls: Restrict access to the device CLI to authorized management IP addresses only and enforce strong, unique credentials for all administrative accounts to limit the potential for unauthorized privilege escalation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of December 18, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability relies on the attacker first obtaining legitimate administrative credentials to access the CLI, which serves as a primary barrier to entry.

Analyst Recommendation

Given the potential for full system compromise, organizations currently utilizing the Ruijie AP180 series must treat this update with high priority. Ensure that all administrative access is strictly controlled and that devices are patched to the latest version to eliminate the command injection vector entirely.

---METADATA---
VENDOR: Ruijie
PRODUCT: Access Points (AP_RGOS)
AFFECTED_VERSIONS: 11.1.x
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/tmogg/security-advisories/blob/main/CVE-2025-65363/README.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.882Z
---END_METADATA---

Description Summary:
An authenticated command injection vulnerability in Ruijie access points allows attackers to execute arbitrary shell commands as root via the web_action.do endpoint.

Executive Summary:
Ruijie access points running firmware version 11.1.x are vulnerable to authenticated command injection, which permits full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-65363

Affected Software: Ruijie Access Points (AP_RGOS)

Affected Versions: 11.1.x

Vulnerability: This vulnerability involves an append-style command injection within the web_action.do endpoint, allowing an authenticated web user to execute shell expressions with root privileges. This grants the attacker the ability to perform file disclosure, disrupt device operations, and facilitate network pivoting.

Business Impact

Successful exploitation allows an attacker to gain full administrative control over the affected access points, leading to potential unauthorized access to internal network traffic. Given the CVSS score of 7.2, this flaw presents a high risk to network integrity and confidentiality, as compromised access points can serve as a persistent foothold for further lateral movement within the environment.

Remediation Plan

Immediate Action: Contact Ruijie support or monitor the official vendor security portal for the release of a firmware update that addresses this command injection flaw.

Proactive Monitoring: Review web access logs for suspicious input strings directed at the web_action.do endpoint, specifically looking for shell-related characters or unusual command parameters.

Compensating Controls: Restrict administrative access to the web management interface of the access points to trusted management IP addresses only, and enforce strong authentication policies to minimize the risk of unauthorized account access.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the security advisory referenced by the researcher.

Analyst Notes: As of December 9, 2025, there is no public information indicating active exploitation in the wild, but the existence of a published proof-of-concept makes the risk of exploitation credible. The vulnerability is inherently dangerous due to the elevation of privileges to the root level.

Analyst Recommendation

This vulnerability represents a significant security risk to network infrastructure because it grants root-level access to critical network hardware. Organizations should prioritize restricting administrative access to these devices immediately and apply the necessary firmware patches as soon as they are made available by Ruijie to prevent potential network compromise.

---METADATA---
VENDOR: Ruijie Networks
PRODUCT: RG-EST300
AFFECTED_VERSIONS: AP_3.0(1)B2P18_EST300_06210514, AP_3.0(1)B2P10_EST300_06151523, AP_3.0(1)B2P10_EST300_05232216, AP_3.0(1)B2P10_EST300_05220814
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://www.ruijie.com.cn/gy/xw-aqtg-gw/929848/","name":null,"tags":[]},{"url":"https://www.ruijie.com/en-global/support/productLifecycle","name":null,"tags":[]},{"url":"https://jvn.jp/en/jp/JVN72648885/","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:07.754Z
---END_METADATA---

Description Summary:
The Ruijie Networks RG-EST300 device includes an undocumented, enabled-by-default SSH server, allowing authenticated high-privilege users to access and potentially compromise the system.

Executive Summary:
The Ruijie Networks RG-EST300 contains an undocumented SSH server enabled by default, which poses a significant risk of unauthorized system configuration changes or denial of service.

Vulnerability Details

CVE-ID: CVE-2025-58778

Affected Software: Ruijie Networks RG-EST300

Affected Versions: AP_3.0(1)B2P18_EST300_06210514, AP_3.0(1)B2P10_EST300_06151523, AP_3.0(1)B2P10_EST300_05232216, and AP_3.0(1)B2P10_EST300_05220814

Vulnerability: This vulnerability involves hidden functionality (CWE-912) where an undocumented SSH server is active in the initial configuration. An attacker with knowledge of the associated credentials can gain high-privilege access to the device.

Business Impact

The ability for an unauthorized party to access the device via an undocumented interface creates a severe security oversight, potentially leading to total loss of device control. Given the CVSS score of 7.2, this vulnerability represents a high risk to network integrity, as attackers could modify configurations or disrupt services, resulting in operational downtime and potential data disclosure.

Remediation Plan

Immediate Action: Organizations should consult the official Ruijie Networks security advisory and apply the recommended firmware updates or configuration hardening steps to disable the undocumented SSH service.

Proactive Monitoring: Security teams should monitor firewall and network access logs for unexpected SSH traffic originating from or directed toward RG-EST300 devices.

Compensating Controls: Restrict access to the device management interface using network segmentation or Access Control Lists (ACLs) to ensure only authorized management workstations can communicate with the device.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of October 17, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk remains high due to the nature of hidden administrative interfaces being exposed by default.

Analyst Recommendation

This vulnerability is particularly concerning because it involves an undocumented feature that remains active without administrator intervention. IT administrators must prioritize identifying all deployed RG-EST300 units within their environment and applying the vendor-supplied patches or configuration changes immediately to eliminate this unauthorized access vector.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-ES series switch
AFFECTED_VERSIONS: ESW_1.0(1)B1P39
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/TNCX-byte/Vulnerability_Research/blob/main/CVE-2025-56752/README.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:03.786Z
---END_METADATA---

Description Summary:
A critical authentication bypass vulnerability in Ruijie RG-ES series switch firmware allows unauthenticated remote attackers to modify administrative settings via crafted HTTP POST requests.

Executive Summary:
A critical authentication bypass vulnerability in Ruijie RG-ES series switches enables unauthenticated remote attackers to gain unauthorized control over device administrative functions.

Vulnerability Details

CVE-ID: CVE-2025-56752

Affected Software: Ruijie RG-ES series switch

Affected Versions: ESW_1.0(1)B1P39

Vulnerability: This flaw is an authentication bypass vulnerability triggered by sending a crafted HTTP POST request to the /user.cgi endpoint, which allows an unauthenticated remote attacker to gain administrative access.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational network integrity. By bypassing authentication, an attacker can modify critical device configurations, potentially leading to unauthorized traffic interception, network disruption, or full device takeover. Given the CVSS score of 9.4, this vulnerability is classified as critical and represents a significant threat to infrastructure availability and confidentiality.

Remediation Plan

Immediate Action: Contact the vendor immediately to obtain the latest firmware update for the affected Ruijie RG-ES series switches, as a specific patch version was not provided in the source data.

Proactive Monitoring: Monitor network traffic for anomalous HTTP POST requests directed toward the /user.cgi endpoint and review device logs for unauthorized administrative configuration changes.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block malicious or unauthorized POST requests targeting the /user.cgi file on administrative interfaces.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the security researcher write-up referenced in the vulnerability record.

Analyst Notes: As of Sep 3, 2025, there is no public information indicating active exploitation in the wild; however, a published proof-of-concept exists via the researcher's technical write-up, which increases the likelihood of exploitation attempts. The vulnerability is highly concerning due to its ease of exploitation over the network without requiring credentials.

Analyst Recommendation

Due to the critical nature of this authentication bypass and the availability of technical details regarding the exploit vector, immediate action is required. Administrators should prioritize the identification of all affected Ruijie RG-ES switches within their environment and apply the latest firmware updates as soon as they are made available by the vendor to prevent unauthorized administrative access.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-S1930 S1930SWITCH_3
AFFECTED_VERSIONS: 3.0(1)B11P230
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EpWU9cQdd5RNszcYlTj2cGsBfiClkCwF0zCsLNYer2VIZA?e=ANIgPM","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56130.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.790Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Ruijie RG-S1930 switch allows authenticated attackers to execute arbitrary system commands via a crafted POST request to the module_update component.

Executive Summary:
An OS command injection vulnerability in Ruijie RG-S1930 switches allows an authenticated attacker to achieve full remote code execution, posing a high risk to network infrastructure.

Vulnerability Details

CVE-ID: CVE-2025-56130

Affected Software: Ruijie RG-S1930 S1930SWITCH_3

Affected Versions: 3.0(1)B11P230

Vulnerability: This is an OS command injection vulnerability (CWE-78) located in the /usr/local/lua/dev_config/ace_sw.lua file. It can be triggered by an authenticated attacker sending a malicious POST request to the module_update parameter.

Business Impact

The ability to execute arbitrary system commands provides an attacker with complete control over the affected network switch. This risk is classified as High with a CVSS score of 8.8, as it facilitates unauthorized access to internal network traffic, potential lateral movement, and complete denial of service for managed segments.

Remediation Plan

Immediate Action: Contact Ruijie support immediately to obtain the latest firmware update or security patch for version 3.0(1)B11P230.

Proactive Monitoring: Review system access logs for anomalous POST requests directed at the module_update endpoint or unexpected execution of shell commands.

Compensating Controls: Implement strict access control lists to limit management interface access to trusted administrative IP addresses only, which reduces the likelihood of exploitation by unauthorized users.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the researcher's write-up on GitHub.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild. However, because a public proof-of-concept is available via the researcher's disclosure, the exploitation risk is credible. The flaw is inherently dangerous due to the lack of input sanitization in the Lua script handling the update module.

Analyst Recommendation

Given the high CVSS score and the existence of a public exploit, this vulnerability should be treated as a priority item for all network administrators. Organizations should verify their firmware versions immediately and restrict access to the device management plane until a verified patch can be applied.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-BCR860
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EqEQemupso9DldgG-EcUI8IBLpEWP_S-f6vpeUtYztYYCg?e=gX4A10","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/EaJ2e_mzgltOiHqb4t8xIvgBoT2CYEP0nrhZd7IYlCHSPQ?e=miUrrL","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56129.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.790Z
---END_METADATA---

Description Summary:
An OS command injection vulnerability in Ruijie RG-BCR860 devices allows authenticated attackers to execute arbitrary system commands via a crafted POST request to the action_diagnosis endpoint.

Executive Summary:
A critical OS command injection vulnerability in Ruijie RG-BCR860 devices allows authenticated attackers to achieve remote code execution on affected hardware.

Vulnerability Details

CVE-ID: CVE-2025-56129

Affected Software: Ruijie RG-BCR860

Affected Versions: See vendor advisory

Vulnerability: This vulnerability is an OS command injection flaw located in the action_diagnosis function of the LuCI controller. It requires the attacker to possess low-level privileges to successfully submit the malicious POST request.

Business Impact

The ability to execute arbitrary OS commands on network appliances poses a severe risk to organizational security. Successful exploitation could lead to full system compromise, unauthorized access to sensitive network traffic, or the deployment of persistent backdoors, justifying the high CVSS score of 8.8.

Remediation Plan

Immediate Action: Contact the vendor immediately to obtain the latest firmware updates or security patches for the RG-BCR860 series.

Proactive Monitoring: Inspect system and web application logs for suspicious POST requests directed at the action_diagnosis endpoint, particularly those containing shell metacharacters.

Compensating Controls: Implement strict network access controls to limit management interface access to authorized administrative IP addresses only, reducing the attack surface for potential exploits.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists via the researcher's published technical documentation on GitHub.

Analyst Notes: As of December 13, 2025, there is no public information indicating active exploitation in the wild. However, because the technical details and a proof-of-concept have been published by researchers, the risk of exploitation by malicious actors is elevated and should be addressed as a priority.

Analyst Recommendation

Given the potential for complete system takeover, administrators must prioritize the identification of all vulnerable Ruijie appliances within their environment. Apply all available security updates immediately to remediate the command injection flaw and minimize the risk of unauthorized remote code execution.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-BCR and RG-BCR600W
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/Evvem8Mw6SlNh-ZJpY_9SAsBq2iDi88TFdFdA1Am3PdfCQ?e=YeLYxb","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/EQkKqI8NW45AgBgScwGNiPABEK0YLvNQFgNtqLaWAhCPVw?e=cLDW5t","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56127.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.790Z
---END_METADATA---

Description Summary:
A command injection vulnerability exists in the Ruijie RG-BCR series, allowing an authenticated attacker to execute arbitrary system commands via a crafted POST request to the get_wanobj endpoint.

Executive Summary:
An OS command injection vulnerability in Ruijie RG-BCR series devices allows authenticated attackers to execute arbitrary code, posing a critical risk to network integrity and system control.

Vulnerability Details

CVE-ID: CVE-2025-56127

Affected Software: Ruijie RG-BCR and RG-BCR600W

Affected Versions: See vendor advisory

Vulnerability: The vulnerability is an OS command injection flaw located in the get_wanobj function within the common.lua controller file. Successful exploitation requires the attacker to have low-level administrative privileges, as indicated by the CVSS vector PR:L, to interact with the vulnerable endpoint.

Business Impact

The ability for an attacker to execute arbitrary commands on network infrastructure devices carries a high risk of full system compromise. Given the CVSS score of 8.8, this vulnerability could lead to unauthorized network access, data exfiltration, or complete device takeover, potentially resulting in significant operational downtime and severe security breaches.

Remediation Plan

Immediate Action: Contact the vendor or consult the official support portal to identify and apply the latest security firmware updates for the affected hardware.

Proactive Monitoring: Review system access logs for anomalous POST requests directed at the get_wanobj path and monitor for unexpected spawned processes originating from the web management interface.

Compensating Controls: Restrict administrative access to the management interface by utilizing network segmentation or an access control list (ACL) to ensure only authorized internal management IP addresses can reach the device.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the security researcher's technical report linked in the CVE record.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild. The vulnerability is inherently dangerous because it allows direct interaction with the underlying operating system through the web controller, and the availability of a public proof-of-concept increases the risk of exploitation by malicious actors.

Analyst Recommendation

Due to the high severity of this command injection vulnerability, organizations using the Ruijie RG-BCR series must treat this as a priority. Administrators should restrict access to the management interface immediately as a stopgap measure and coordinate with the vendor to deploy the necessary patches to remediate the flaw permanently.

---METADATA---
VENDOR: Ruijie
PRODUCT: X60 PRO
AFFECTED_VERSIONS: V1.00, V2.00
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EqOEJce7qVtBlzpFonUkSfYBz09eegk6KowUdpDNexgUvw?e=qfwDKh","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/EWnUygFXeTVNigjp81gJ3LQBJ-hCSb_Yq4gGIMxlan7uJg?e=emOIoc","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56124.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.790Z
---END_METADATA---

Description Summary:
A command injection vulnerability in Ruijie X60 PRO allows authenticated local attackers to execute arbitrary system commands via a crafted POST request to the networkConnect.lua module.

Executive Summary:
An OS command injection vulnerability in Ruijie X60 PRO firmware versions V1.00 and V2.00 poses a significant risk of total system compromise through unauthorized command execution.

Vulnerability Details

CVE-ID: CVE-2025-56124

Affected Software: Ruijie X60 PRO

Affected Versions: V1.00, V2.00

Vulnerability: This vulnerability is an OS command injection flaw located in the /usr/local/lua/dev_sta/networkConnect.lua file. An attacker with low-level local privileges can trigger the execution of arbitrary system commands by sending a specially crafted POST request to the module_get endpoint.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with the privileges of the underlying service, potentially leading to full control over the affected networking hardware. With a CVSS score of 7.8, this flaw represents a high-severity risk that could facilitate lateral movement within the network, unauthorized data access, or the disruption of critical communication services.

Remediation Plan

Immediate Action: Since a vendor patch is currently unknown, administrators should restrict network access to the management interface and monitor the device for suspicious traffic. Contact Ruijie support directly to inquire about a firmware update that addresses this specific command injection vulnerability.

Proactive Monitoring: Review system logs for unusual POST requests directed at the networkConnect.lua file or any unexpected execution of shell commands.

Compensating Controls: Implement strict network access control lists to ensure that only authorized administrative workstations can communicate with the device management interface, effectively mitigating the risk of exploitation by unauthorized local users.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the researcher's technical write-up on GitHub.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild; however, a published technical write-up detailing the attack vector exists, which constitutes a public exploit. The vulnerability is inherently dangerous because it allows direct interaction with the underlying operating system through a web-based module.

Analyst Recommendation

Given the high CVSS score and the public availability of technical details regarding the exploit, this vulnerability must be treated with urgency. Administrators should prioritize isolating the affected Ruijie X60 PRO devices from untrusted segments and maintain close communication with the vendor for official patch releases to remediate this command injection flaw permanently.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-EW1200G PRO
AFFECTED_VERSIONS: V1.00, V2.00, V3.00, V4.00
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EkH0xWseMXBJg-Ck_uD34fcB-3pDo3MAQc2AKNlXqwYr2w?e=GU9l62","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/ERjNMNZRBD5HoYydt7Kb3kwBT4ycJXROxTsVBB-WXXqH6Q?e=q8Lcd2","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56123.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.790Z
---END_METADATA---

Description Summary:
An OS command injection vulnerability exists in Ruijie RG-EW1200G PRO devices, allowing authenticated attackers to execute arbitrary system commands via a crafted POST request.

Executive Summary:
A critical OS command injection vulnerability in Ruijie RG-EW1200G PRO devices allows authenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-56123

Affected Software: Ruijie RG-EW1200G PRO

Affected Versions: V1.00, V2.00, V3.00, V4.00

Vulnerability: This is an OS command injection flaw located in the module_get function within the file /usr/local/lua/dev_sta/networkConnect.lua, which can be triggered by an authenticated attacker via a crafted POST request.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting a high risk of total system compromise. Successful exploitation grants an attacker the ability to execute arbitrary commands with the privileges of the underlying service, potentially leading to unauthorized data access, network lateral movement, or complete device takeover.

Remediation Plan

Immediate Action: Contact the vendor or monitor the official support portal for the release of a security patch, as no official fix has been confirmed at this time.

Proactive Monitoring: Inspect network traffic and device logs for suspicious POST requests targeting the /usr/local/lua/dev_sta/networkConnect.lua endpoint.

Compensating Controls: Restrict administrative access to the device management interface to trusted IP addresses only and disable remote management features if they are not strictly required for operations.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the researcher's GitHub repository.

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation in the wild. The vulnerability is highly dangerous because it facilitates direct OS command execution, and the existence of a published proof-of-concept increases the likelihood that threat actors may attempt to weaponize this flaw.

Analyst Recommendation

Given the severity of command injection and the availability of technical details, administrators must prioritize the protection of these devices. Until a vendor patch is applied, limit exposure by isolating the management interface from the public internet or untrusted network segments to prevent exploitation by malicious actors.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-EW1800GX PRO
AFFECTED_VERSIONS: B11P226_EW1800GX-PRO_10223117
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/Eohr-0awt6VAuiLCNhCG0rgBLQip6nJpl-9Hy0OqB4MvFg?e=DIfBxi","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/EZOBtzLwlmBKschv6sxT_LcBBKnMP_OXO7d24321UD8x8g?e=Dpui5j","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56122.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.790Z
---END_METADATA---

Description Summary:
An OS command injection vulnerability in Ruijie RG-EW1800GX PRO allows authenticated attackers to execute arbitrary system commands via a crafted POST request to the networkConnect module.

Executive Summary:
A critical OS command injection vulnerability in the Ruijie RG-EW1800GX PRO router allows authenticated attackers to achieve full system compromise via arbitrary command execution.

Vulnerability Details

CVE-ID: CVE-2025-56122

Affected Software: Ruijie RG-EW1800GX PRO

Affected Versions: B11P226_EW1800GX-PRO_10223117

Vulnerability: The device is susceptible to OS command injection through the module_get function within the /usr/local/lua/dev_sta/networkConnect.lua file. The vulnerability requires the attacker to have established authenticated access to the device to submit a crafted POST request.

Business Impact

Successful exploitation of this vulnerability permits an attacker to execute arbitrary commands on the underlying operating system with elevated privileges. This results in a total compromise of the device, potentially allowing for lateral movement within the network, traffic interception, or permanent denial of service. The CVSS score of 8.8 reflects the high severity of this flaw, as it grants complete control over the affected hardware.

Remediation Plan

Immediate Action: Contact Ruijie support immediately to verify if a firmware update is available for this specific build, as no public patch is currently confirmed.

Proactive Monitoring: Inspect system logs for unusual POST requests directed at the networkConnect module or unexpected execution of shell commands originating from the web management interface.

Compensating Controls: Restrict access to the device management interface to trusted administrative IP addresses only, and disable remote management features if they are not strictly required for business operations.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists via the technical write-up published on GitHub.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild. However, a published proof-of-concept exists, which elevates the risk of exploitation by malicious actors. The flaw is inherently dangerous due to the lack of input sanitization in the affected Lua script.

Analyst Recommendation

Given the potential for total system compromise, administrators must prioritize the protection of the management interface. If a vendor-supplied patch is not available, isolate the device from untrusted networks immediately to prevent unauthorized access. Monitor for any signs of exploitation until a verified firmware update can be applied.

---METADATA---
VENDOR: Ruijie
PRODUCT: X60 PRO
AFFECTED_VERSIONS: V1.00, V2.00
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EqOEJce7qVtBlzpFonUkSfYBz09eegk6KowUdpDNexgUvw?e=qfwDKh","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/EZf6v9BXDpFAs09oCidKJ8oBXclUWtjyMcQv3DgMfISkJg?e=MyjOdI","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56120.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.794Z
---END_METADATA---

Description Summary:
A command injection vulnerability in Ruijie X60 PRO allows authenticated attackers to execute arbitrary system commands via a crafted POST request to the config_retain.lua module.

Executive Summary:
An OS command injection vulnerability exists in the Ruijie X60 PRO firmware that allows authenticated attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-56120

Affected Software: Ruijie X60 PRO

Affected Versions: V1.00, V2.00

Vulnerability: This vulnerability is an OS command injection flaw located in the module_set function within the /usr/local/lua/dev_config/config_retain.lua file. It allows an attacker with low-level privileges to execute arbitrary system commands by sending a maliciously crafted POST request.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the underlying operating system. This could lead to a complete loss of confidentiality, integrity, and availability, enabling the attacker to pivot into the internal network or disrupt critical communication services. With a CVSS score of 8.8, this flaw represents a high risk to organizational infrastructure.

Remediation Plan

Immediate Action: Restrict access to the management interface of the Ruijie X60 PRO to trusted internal networks only and monitor for vendor-provided firmware updates.

Proactive Monitoring: Review device access logs and network traffic for suspicious POST requests targeting the /usr/local/lua/dev_config/config_retain.lua endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent network inspection tool to filter and block POST requests containing shell metacharacters or unauthorized command strings directed at the management module.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up referenced by the CVE record.

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation in the wild; however, a functional proof-of-concept has been published, which elevates the risk of exploitation. The flaw is inherently dangerous due to the lack of sufficient input sanitization in the affected Lua script.

Analyst Recommendation

Given the high CVSS score and the existence of a public proof-of-concept, administrators should prioritize securing affected devices immediately. Until a vendor patch is released and verified, ensure that the management interface is not exposed to the internet and audit all user accounts with administrative access to prevent unauthorized utilization of this injection vector.

---METADATA---
VENDOR: Ruijie
PRODUCT: X60 PRO
AFFECTED_VERSIONS: V1.00/V2.00
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/t/c/12406a392c92914b/EV2jr71QaoFBjf3SLQcUA6sBcmzSsyx2jJ_XY7yOBk_Sjg?e=WOY7Wd","name":null,"tags":[]},{"url":"https://1drv.ms/f/c/12406a392c92914b/EqOEJce7qVtBlzpFonUkSfYBz09eegk6KowUdpDNexgUvw?e=qfwDKh","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56118.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.794Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Ruijie X60 PRO router allows authenticated attackers to execute arbitrary system commands via a crafted POST request to a specific Lua module.

Executive Summary:
An OS command injection vulnerability in the Ruijie X60 PRO allows authenticated attackers to achieve remote code execution on affected hardware.

Vulnerability Details

CVE-ID: CVE-2025-56118

Affected Software: Ruijie X60 PRO

Affected Versions: V1.00/V2.00

Vulnerability: The vulnerability exists within the nbr_cwmp.lua file, where the module_set function fails to properly sanitize input. An attacker with low-level privileges can leverage this flaw to execute arbitrary system commands via a crafted POST request.

Business Impact

This vulnerability carries a CVSS score of 8.8, reflecting its high severity. Successful exploitation allows an attacker to gain full control over the network device, which may lead to unauthorized network access, data interception, or the use of the router as a pivot point for further lateral movement within the corporate environment.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, users should restrict access to the web management interface to trusted management networks only and monitor vendor channels for firmware updates.

Proactive Monitoring: Security teams should monitor device logs for suspicious POST requests targeting the /usr/local/lua/dev_sta/nbr_cwmp.lua endpoint or unusual shell activity originating from the device.

Compensating Controls: Implement strict firewall rules to block unauthorized access to the web management interface from external or untrusted network segments.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the vulnerability report provided on GitHub.

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation in the wild; however, a public proof-of-concept is available via the researcher's GitHub repository. The flaw is considered highly exploitable given the lack of input sanitization in the identified Lua module.

Analyst Recommendation

Given the severity of this command injection flaw, organizations should prioritize isolating the affected Ruijie X60 PRO devices from internet-facing segments. Administrators must verify if their firmware version is vulnerable and apply official security updates as soon as they are made available by the vendor to prevent potential system compromise.

---METADATA---
VENDOR: Ruijie
PRODUCT: X30-PRO
AFFECTED_VERSIONS: X30-PRO-V1_09241521
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EtGIxwWujwxBvQhL9wgnUIwBkg-mndJJX07Igr6d0cic-g?e=4KJbWY","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/Ed2lBCN9vhdPnEs7WKvpfEQBp7czazgO9PYxS2TFSHx7TQ?e=HZZaGq","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56117.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.794Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Ruijie X30-PRO router allows authenticated attackers to execute arbitrary system commands via a crafted POST request to the module_set endpoint.

Executive Summary:
An OS command injection vulnerability in Ruijie X30-PRO firmware allows authenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-56117

Affected Software: Ruijie X30-PRO

Affected Versions: X30-PRO-V1_09241521

Vulnerability: The flaw exists in the processing of POST requests within the /usr/local/lua/dev_sta/nbr_cwmp.lua file. By injecting malicious input into the module_set parameter, an authenticated attacker can trigger arbitrary OS command execution with high privileges.

Business Impact

Successful exploitation of this vulnerability grants an attacker complete control over the affected network device. This poses a severe risk to organizational security, as it facilitates lateral movement, potential interception of network traffic, and the establishment of persistent backdoors within the network infrastructure. With a CVSS score of 8.8, this vulnerability is considered high severity due to the high impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict management access to the device to trusted IP addresses only and disable remote administration features if they are not strictly required.

Proactive Monitoring: Monitor device access logs for suspicious POST requests directed at the module_set endpoint or unusual outbound traffic originating from the router that may indicate command-and-control communication.

Compensating Controls: Deploy a Web Application Firewall or network-based intrusion detection system rules to filter and block malformed or suspicious POST requests targeting the device management interface.

Exploitation Status

Public Exploit Available: Yes, a technical write-up containing attack details and proof-of-concept information is available via the referenced GitHub repository.

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation in the wild. However, the availability of a public write-up documenting the injection mechanism elevates the risk of exploitation by malicious actors.

Analyst Recommendation

Given the potential for total system compromise, organizations currently utilizing the Ruijie X30-PRO should prioritize network isolation for these devices. Ensure that management interfaces are not exposed to the public internet and maintain rigorous monitoring for any unauthorized configuration changes or anomalous activity until a vendor-supplied firmware update is released and applied.

---METADATA---
VENDOR: Ruijie
PRODUCT: M18 EW_3
AFFECTED_VERSIONS: M18 EW_3.0(1)B11P226_M18_10223116
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EmXarTTNPwFHjk8lLwQIqj8Ba9nlq-owLMBtEKpBwMrn5A?e=vvi2dM","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/EWfEhLkTSblOur72XhaQ7W4BsxQ1IWXZ-Wkcv9WC7AYb-g?e=LpMdqT","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56114.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.794Z
---END_METADATA---

Description Summary:
A command injection vulnerability in Ruijie M18 EW_3 allows authenticated attackers to execute arbitrary system commands via a crafted POST request to the module_set endpoint.

Executive Summary:
An OS command injection vulnerability in the Ruijie M18 EW_3 router allows authenticated attackers to achieve full system compromise via malicious POST requests.

Vulnerability Details

CVE-ID: CVE-2025-56114

Affected Software: Ruijie M18 EW_3

Affected Versions: M18 EW_3.0(1)B11P226_M18_10223116

Vulnerability: The flaw exists in the module_set function within the file /usr/local/lua/dev_config/config_retain.lua. It allows an authenticated attacker to inject and execute arbitrary OS commands on the underlying host.

Business Impact

This vulnerability carries a CVSS score of 8.8, reflecting a high risk of total system compromise. Successful exploitation grants an attacker the ability to execute code with elevated privileges, which could lead to unauthorized data access, network lateral movement, or complete denial of service of the affected networking hardware.

Remediation Plan

Immediate Action: Contact the vendor immediately to obtain firmware updates that address the insecure handling of the module_set parameter, as no public patch is currently confirmed.

Proactive Monitoring: Review system logs for unusual POST requests directed at /usr/local/lua/dev_config/config_retain.lua and monitor for unexpected spawned processes or outbound network traffic from the device.

Compensating Controls: Restrict administrative access to the router interface to trusted management IP addresses and ensure that the device is not reachable from the public internet to prevent unauthorized authentication.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up published on GitHub.

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation in the wild, though the availability of a functional proof-of-concept makes this a credible threat. The vulnerability is inherently dangerous due to the direct nature of OS command injection in a network device.

Analyst Recommendation

Given the high CVSS score and the presence of a public proof-of-concept, this vulnerability poses a significant risk to network infrastructure. Administrators should prioritize restricting access to the management interface and coordinate with Ruijie support to verify if a firmware update is available for their specific deployment.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-YST EST, YSTAP_3
AFFECTED_VERSIONS: YSTAP_3.0(1)B11P280YST250F V1.xxV2.xx
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/t/c/12406a392c92914b/EY_XOykAOvJJkGsDkmahTboBmmvNWczbXF3brroYsTWmTA?e=2Itzta","name":null,"tags":[]},{"url":"https://1drv.ms/f/c/12406a392c92914b/EsGqqVSQqCVBjjz2FhAHAiAB4MCHo41vIuw2wPgLykbupA?e=YgF1gt","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56113.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.794Z
---END_METADATA---

Description Summary:
A command injection vulnerability in Ruijie RG-YST EST and YSTAP_3 allows authenticated attackers to execute arbitrary system commands via a crafted POST request to the pwdmodify endpoint.

Executive Summary:
An OS command injection vulnerability in Ruijie RG-YST EST and YSTAP_3 devices poses a critical risk by allowing authenticated attackers to execute arbitrary commands with high system privileges.

Vulnerability Details

CVE-ID: CVE-2025-56113

Affected Software: Ruijie RG-YST EST, YSTAP_3

Affected Versions: YSTAP_3.0(1)B11P280YST250F V1.xxV2.xx

Vulnerability: The vulnerability is an OS command injection flaw located in the pwdmodify function within the /usr/lib/lua/luci/modules/common.lua file. It requires the attacker to have low-level privileges to successfully submit the crafted POST request.

Business Impact

The ability to execute arbitrary OS commands on network infrastructure devices can lead to total system compromise, including unauthorized data access, network interception, and complete loss of device control. Given the CVSS score of 8.8, this vulnerability is classified as High severity, representing a significant risk to the integrity and availability of the affected network environment.

Remediation Plan

Immediate Action: Contact the vendor or consult the official Ruijie security portal to obtain firmware updates that address this command injection vulnerability.

Proactive Monitoring: Review system access logs for suspicious POST requests targeting the pwdmodify endpoint, particularly those containing shell metacharacters or unexpected command strings.

Compensating Controls: Implement strict network access control lists to restrict management interface access to authorized administrative IP addresses only, effectively reducing the attack surface.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists via the technical write-up referenced in the CVE record.

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation in the wild. The vulnerability is highly exploitable due to the lack of input sanitization in the affected Lua module.

Analyst Recommendation

The severity of this command injection vulnerability necessitates prompt action to secure affected Ruijie devices. Administrators should prioritize identifying and patching all vulnerable instances of RG-YST EST and YSTAP_3, as the existence of a public proof-of-concept increases the likelihood of exploitation attempts.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-BCR860
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EqEQemupso9DldgG-EcUI8IBLpEWP_S-f6vpeUtYztYYCg?e=gX4A10","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/ERJa0DnnR29MqtbLLRQirGYB4qA9dAdpn6eIJH9LwNlBmw?e=y6KkGo","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56111.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.794Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Ruijie RG-BCR860 allows authenticated attackers to execute arbitrary system commands via a crafted POST request to the network_set_wan_conf endpoint.

Executive Summary:
An OS command injection vulnerability in Ruijie RG-BCR860 devices poses a high risk of total system compromise for organizations failing to restrict administrative access.

Vulnerability Details

CVE-ID: CVE-2025-56111

Affected Software: Ruijie RG-BCR860

Affected Versions: See vendor advisory

Vulnerability: The vulnerability is an OS command injection flaw located within the network_set_wan_conf function of the Lua controller file. Based on the CVSS vector (PR:L), this vulnerability requires the attacker to have low-level administrative credentials to successfully trigger the command execution.

Business Impact

Successful exploitation allows an attacker to execute arbitrary commands on the underlying operating system of the network device. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to full device takeover, enabling lateral movement within the network, unauthorized interception of traffic, or complete denial of service.

Remediation Plan

Immediate Action: Contact Ruijie support or monitor the vendor portal for the release of a security patch addressing this command injection flaw.

Proactive Monitoring: Review device access logs for suspicious POST requests directed at the network_set_wan_conf endpoint, particularly those containing shell metacharacters.

Compensating Controls: Restrict access to the device management interface to trusted administrative IP addresses only, and implement network segmentation to isolate the management plane from general user traffic.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the research write-up hosted on GitHub.

Analyst Notes: As of December 13, 2025, there is no confirmed active exploitation in the wild; however, a published proof-of-concept exists via the researcher's write-up, making the exploitation risk credible. The vulnerability is highly exploitable for any actor possessing valid low-level administrative credentials.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention from network administrators. Until a vendor patch is applied, organizations must ensure that administrative interfaces are not exposed to the public internet and that access is strictly limited to authorized personnel to prevent exploitation of this command injection vector.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-BCR860
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EqEQemupso9DldgG-EcUI8IBLpEWP_S-f6vpeUtYztYYCg?e=gX4A10","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/Eebxh85meOlFnvAANaOt7WgBy_WVGYtW6X8dzvZBZSenbw?e=aaqmPN","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56109.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.794Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Ruijie RG-BCR860 allows authenticated users to execute arbitrary OS commands via a crafted POST request to the wireless control interface.

Executive Summary:
An OS command injection vulnerability in Ruijie RG-BCR860 devices poses a critical risk of full system compromise for authenticated users.

Vulnerability Details

CVE-ID: CVE-2025-56109

Affected Software: Ruijie RG-BCR860

Affected Versions: See vendor advisory

Vulnerability: This is an OS command injection vulnerability triggered by sending a malicious POST request to the action_wireless function located in the administration interface file /usr/lib/lua/luci/control/admin/wireless.lua. Per the CVSS vector PR:L, this vulnerability requires the attacker to have low-level authenticated access to the device.

Business Impact

Successful exploitation allows an attacker to execute arbitrary commands at the operating system level with administrative privileges. This effectively grants the attacker full control over the network appliance, potentially leading to unauthorized data exfiltration, lateral movement within the network, and complete service disruption. With a CVSS score of 8.8, this flaw represents a high-severity risk that demands immediate attention to maintain network integrity.

Remediation Plan

Immediate Action: Contact Ruijie support or check the official vendor portal for the latest firmware release that addresses this command injection flaw.

Proactive Monitoring: Inspect system logs for unusual POST requests directed at the wireless administration scripts and monitor for unexpected outbound network traffic originating from the device.

Compensating Controls: Restrict access to the device management interface to trusted administrative IP addresses only, and utilize a Web Application Firewall (WAF) to filter malicious payloads in POST requests.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as detailed in the technical report hosted on GitHub.

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation in the wild, though a published proof-of-concept exists via the researcher's write-up. The vulnerability is highly exploitable for any user with valid administrative credentials.

Analyst Recommendation

Given the potential for remote code execution and the availability of a public proof-of-concept, users must treat this vulnerability with high priority. Organizations should immediately audit their Ruijie infrastructure for exposure and implement strict access controls on the management interface until an official patch is verified and applied.

---METADATA---
VENDOR: Ruijie
PRODUCT: X30-PRO
AFFECTED_VERSIONS: X30-PRO-V1_09241521
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EtGIxwWujwxBvQhL9wgnUIwBkg-mndJJX07Igr6d0cic-g?e=4KJbWY","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/Ecib6--fxv9HhrfAdhmP5R4BOPDcTcqTOBt0hQBEx5BTxA?e=s3ejN1","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56108.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.794Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Ruijie X30-PRO router allows authenticated attackers to execute arbitrary system commands via a crafted POST request to the pwdmodify endpoint.

Executive Summary:
The Ruijie X30-PRO router is susceptible to an OS command injection vulnerability that allows authenticated attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-56108

Affected Software: Ruijie X30-PRO

Affected Versions: X30-PRO-V1_09241521

Vulnerability: This vulnerability is an OS command injection flaw located in the pwdmodify function within the common.lua file. It requires the attacker to have low-level privileges to successfully submit a crafted POST request that triggers the execution of arbitrary commands.

Business Impact

Successful exploitation of this vulnerability leads to full system compromise, granting an attacker the ability to execute arbitrary code with the privileges of the web server. Given the CVSS score of 8.8, this represents a high risk to business operations, as it could facilitate unauthorized data access, network lateral movement, or the complete disruption of network services provided by the device.

Remediation Plan

Immediate Action: Contact the vendor to verify the availability of a firmware update that addresses this command injection flaw and apply it immediately upon release.

Proactive Monitoring: Monitor device access logs for suspicious POST requests targeting the pwdmodify endpoint and investigate any unexpected system process executions.

Compensating Controls: Restrict administrative access to the device management interface to trusted internal IP addresses only, and employ a Web Application Firewall (WAF) to inspect traffic for common command injection patterns.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research repository hosted on GitHub.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild. The vulnerability is highly exploitable due to the lack of input sanitization in the affected Lua module, and the presence of a published proof-of-concept necessitates immediate defensive prioritization.

Analyst Recommendation

Given the high severity of this vulnerability and the potential for full device takeover, organizations utilizing the Ruijie X30-PRO must treat this as a critical security priority. Administrators should restrict management access to the device immediately and prioritize the deployment of a vendor-supplied firmware patch as soon as it becomes available.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-BCR and RG-BCR600W
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/Evvem8Mw6SlNh-ZJpY_9SAsBq2iDi88TFdFdA1Am3PdfCQ?e=YeLYxb","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/ESr3_xpg5ZxFkRAKG7hiGVcBF3Cw_52dWpSvUOtgx3hPhw?e=c5RTxg","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56107.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.794Z
---END_METADATA---

Description Summary:
A command injection vulnerability in Ruijie RG-BCR and RG-BCR600W devices allows authenticated attackers to execute arbitrary system commands via crafted POST requests.

Executive Summary:
An OS command injection vulnerability in Ruijie network appliances poses a high risk of full system compromise for authenticated users.

Vulnerability Details

CVE-ID: CVE-2025-56107

Affected Software: Ruijie RG-BCR and RG-BCR600W

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves an OS command injection flaw located within the submit_wifi function in the common_quick_config controller. The vulnerability requires the attacker to have low-level privileges (authenticated access) to send a malicious POST request that triggers arbitrary command execution on the underlying operating system.

Business Impact

The exploitation of this vulnerability allows an attacker to gain full control over the affected Ruijie network appliances. With a CVSS score of 8.8, this flaw represents a significant risk to organizational infrastructure, potentially leading to unauthorized data access, network disruption, or the use of the device as a pivot point for further lateral movement within the corporate network.

Remediation Plan

Immediate Action: Contact Ruijie support or check the official vendor portal for the latest firmware updates addressing this vulnerability.

Proactive Monitoring: Review device access logs for unusual POST requests directed at the common_quick_config endpoint or unauthorized attempts to execute system-level commands.

Compensating Controls: Restrict administrative management interfaces to trusted management subnets and deploy WAF rules to inspect and filter suspicious traffic directed at the administration interface.

Exploitation Status

Public Exploit Available: Yes, a published PoC exists, attributed to the research documentation referenced by the CVE.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild. The vulnerability is inherently dangerous because it allows direct interaction with the underlying OS shell via a common administrative endpoint.

Analyst Recommendation

Given the high CVSS severity and the availability of a proof-of-concept, administrators should prioritize updating their Ruijie devices as soon as an official patch becomes available. Until a patch is applied, limit administrative access to the device to prevent unauthorized users from reaching the vulnerable endpoint.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-EW1800GX
AFFECTED_VERSIONS: B11P226_EW1800GX_10223121
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EgUg1zJuaItDmLxZhkCg4B8BcJTRYnXyX4ePIIjNoZrRew?e=a23cK6","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/EcUP8SMciOVBgNEy31-OnnkBQRk_fUCDWUtdDX8UBfbXEA?e=FuQDPi","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56106.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.798Z
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the Ruijie RG-EW1800GX allows authenticated attackers to execute arbitrary commands via a crafted POST request to the module_set endpoint.

Executive Summary:
A critical OS command injection vulnerability in the Ruijie RG-EW1800GX router allows authenticated attackers to achieve full system compromise via arbitrary command execution.

Vulnerability Details

CVE-ID: CVE-2025-56106

Affected Software: Ruijie RG-EW1800GX

Affected Versions: B11P226_EW1800GX_10223121

Vulnerability: This flaw is an OS command injection vulnerability located in the file /usr/local/lua/dev_sta/nbr_cwmp.lua. An attacker with low-level privileges can trigger the injection by sending a specially crafted POST request to the module_set function.

Business Impact

The ability to execute arbitrary commands on network infrastructure poses a severe risk to organizational security, potentially leading to unauthorized data exfiltration, lateral movement within the network, or complete denial of service. With a CVSS score of 8.8, this vulnerability represents a high-severity threat that could facilitate the total compromise of the affected device and the traffic passing through it.

Remediation Plan

Immediate Action: Contact Ruijie support or check the official vendor portal for firmware updates addressing this command injection flaw. Until a patch is verified, restrict access to the device management interface to trusted administrative networks only.

Proactive Monitoring: Monitor system logs for unusual POST requests directed at the nbr_cwmp.lua file or unexpected shell activity originating from the device.

Compensating Controls: Implement strict network segmentation and utilize a Web Application Firewall (WAF) or equivalent inspection tool to filter and block malicious POST requests targeting the identified module_set endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the vulnerability report hosted on GitHub.

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation in the wild. However, the presence of a published proof-of-concept repository increases the risk of development of weaponized exploit code. Given the nature of command injection flaws, this vulnerability should be considered highly dangerous.

Analyst Recommendation

Given the high CVSS score and the existence of a public proof-of-concept, this vulnerability warrants immediate attention from network administrators. Organizations should prioritize isolating affected Ruijie devices from public-facing segments and applying vendor-supplied patches as soon as they become available to mitigate the risk of remote command execution.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-EW1800GX
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EgUg1zJuaItDmLxZhkCg4B8BcJTRYnXyX4ePIIjNoZrRew?e=a23cK6","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/EXNcf0lLKjZLv6U4-ErArMkBKqwLJhJbiJwuQl5MSd0W3w?e=GfXnnz","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56102.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.798Z
---END_METADATA---

Description Summary:
An OS command injection vulnerability exists in the Ruijie RG-EW1800GX router, allowing authenticated attackers to execute arbitrary system commands via a crafted POST request.

Executive Summary:
A critical OS command injection vulnerability in Ruijie RG-EW1800GX routers allows authenticated attackers to achieve remote code execution, posing a significant risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2025-56102

Affected Software: Ruijie RG-EW1800GX

Affected Versions: See vendor advisory

Vulnerability: This vulnerability is an OS command injection flaw located within the networkConnect.lua script. Attackers with low-level privileges can trigger this issue by sending a crafted POST request to the module_get endpoint, leading to full system command execution.

Business Impact

The ability to execute arbitrary commands on network infrastructure represents a critical security failure, as it allows for complete system compromise. With a CVSS score of 8.8, this vulnerability could facilitate lateral movement, unauthorized data access, or the redirection of network traffic, leading to significant operational disruption and loss of trust.

Remediation Plan

Immediate Action: Contact the vendor or monitor the official Ruijie support portal for the release of a security patch addressing the command injection flaw in the RG-EW1800GX firmware.

Proactive Monitoring: Implement strict access control lists to limit who can interact with the device management interface and monitor system logs for suspicious POST requests directed at the networkConnect module.

Compensating Controls: Deploy a Web Application Firewall or network-based intrusion detection system to inspect and filter malicious traffic patterns targeting device management endpoints.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research repository referenced in the CVE record.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild. However, given the availability of a public proof-of-concept, the risk of exploitation by threat actors is credible and should be addressed as a high priority.

Analyst Recommendation

Given the potential for full system compromise via command injection, administrators should prioritize the deployment of firmware updates as soon as they become available. In the interim, ensure that device management interfaces are not exposed to the public internet and that internal access is restricted to authorized administrative personnel only.

---METADATA---
VENDOR: Ruijie
PRODUCT: M18 EW_3
AFFECTED_VERSIONS: 3.0(1)B11P226_M18_10223116
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EmXarTTNPwFHjk8lLwQIqj8Ba9nlq-owLMBtEKpBwMrn5A?e=vvi2dM","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/EbNlU_0K0v1Krzq7CaUWn0AB_yu3ICrdmwoVuS2txFGMhA?e=0gIUMh","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56101.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.798Z
---END_METADATA---

Description Summary:
A command injection vulnerability in Ruijie M18 EW_3 allows authenticated attackers to execute arbitrary system commands via a crafted POST request to the networkConnect.lua module.

Executive Summary:
An OS command injection vulnerability in Ruijie M18 EW_3 routers allows authenticated attackers to achieve remote code execution, posing a severe risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2025-56101

Affected Software: Ruijie M18 EW_3

Affected Versions: 3.0(1)B11P226_M18_10223116

Vulnerability: This vulnerability is an OS command injection flaw located in the /usr/local/lua/dev_sta/networkConnect.lua file. It permits an authenticated attacker to inject and execute arbitrary system commands by sending a maliciously crafted POST request to the module_get endpoint.

Business Impact

The ability to execute arbitrary commands on network infrastructure allows an attacker to gain full control over the device, potentially leading to unauthorized network access, data interception, or the use of the router as a pivot point for further attacks. With a CVSS score of 8.8, this vulnerability is classified as High severity, reflecting the significant potential for system compromise and operational disruption.

Remediation Plan

Immediate Action: Administrators should restrict management interface access to trusted networks and monitor for vendor-provided firmware updates that address this specific vulnerability.

Proactive Monitoring: Security teams should monitor system logs for suspicious POST requests directed at the networkConnect.lua file and look for unexpected process execution patterns on the router.

Compensating Controls: Implement strict network access control lists to limit the exposure of the administrative interface to only authorized IP addresses, effectively reducing the attack surface.

Exploitation Status

Public Exploit Available: Yes, a public proof of concept exists, as documented in the technical report referenced on GitHub by the vulnerability researcher.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild. The vulnerability is highly exploitable for any authenticated user, and the availability of a published technical write-up increases the likelihood of attempted exploitation by malicious actors.

Analyst Recommendation

Given the high CVSS score and the ease of command execution once authenticated, this vulnerability represents a significant risk to organizational security. Administrators are urged to prioritize the hardening of device management interfaces and to apply vendor patches immediately upon release to prevent unauthorized code execution.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-YST AP
AFFECTED_VERSIONS: 3.0(1)B11P280YST250F
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/t/c/12406a392c92914b/ETaD7apCrPFLtMj473NHV2gBaYrKV9A4ZZKMfyWgC949Zw?e=iyjx5g","name":null,"tags":[]},{"url":"https://1drv.ms/f/c/12406a392c92914b/EjgEtJ5yojhDpEoT-PbidhsBzsbVnT-D-32qK1bCrQN3-g?e=cVRYgN","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56099.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.798Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Ruijie RG-YST AP allows authenticated attackers to execute arbitrary system commands via a crafted POST request.

Executive Summary:
A critical OS command injection vulnerability in Ruijie RG-YST AP devices allows authenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-56099

Affected Software: Ruijie RG-YST AP

Affected Versions: 3.0(1)B11P280YST250F

Vulnerability: This is an OS command injection vulnerability located within the pwdmodify function of the /usr/lib/lua/luci/modules/common.lua file. The vulnerability is triggered by an authenticated attacker sending a malicious POST request to the affected endpoint.

Business Impact

The ability to execute arbitrary OS commands poses a severe risk to organizational infrastructure, as it grants attackers the potential for full control over the affected access point. A successful exploit could lead to complete system compromise, unauthorized lateral movement within the network, and potential data exfiltration. With a CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized access to internal network segments.

Remediation Plan

Immediate Action: Contact the vendor immediately to obtain the latest security firmware update for the RG-YST AP platform. If a patch is not yet available, restrict administrative access to the management interface to trusted internal IP addresses only.

Proactive Monitoring: Review system logs for suspicious HTTP POST requests directed toward the /usr/lib/lua/luci/modules/common.lua endpoint. Monitor for unexpected shell execution or unauthorized configuration changes on the affected devices.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to inspect and filter POST requests containing suspicious command injection patterns. Isolate the affected devices in a restricted VLAN to minimize the potential blast radius of a successful compromise.

Exploitation Status

Public Exploit Available: Yes, a published PoC exists, attributed to the security research write-up hosted on GitHub.

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation in the wild. The vulnerability is inherently dangerous due to the lack of input sanitization in the underlying Lua module, which directly facilitates command execution.

Analyst Recommendation

Given the potential for complete system takeover, administrators should treat this vulnerability with high priority. Apply the vendor-supplied security patch as soon as it is released, and ensure that management interfaces are not exposed to the public internet. Failure to mitigate this flaw increases the risk of persistent unauthorized access to your wireless infrastructure.

---METADATA---
VENDOR: Ruijie
PRODUCT: X30-PRO
AFFECTED_VERSIONS: X30-PRO-V1_09241521
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EtGIxwWujwxBvQhL9wgnUIwBkg-mndJJX07Igr6d0cic-g?e=4KJbWY","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/EYC9-EvSxKZOum9kuAtPDq4BjKb0c8IV6B52lDEAD33pEA?e=2C0BKO","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56098.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.798Z
---END_METADATA---

Description Summary:
A command injection vulnerability in Ruijie X30-PRO allows authenticated attackers to execute arbitrary system commands via a crafted POST request to the networkConnect module.

Executive Summary:
An OS command injection vulnerability in the Ruijie X30-PRO router allows authenticated attackers to gain full system control through malicious network requests.

Vulnerability Details

CVE-ID: CVE-2025-56098

Affected Software: Ruijie X30-PRO

Affected Versions: X30-PRO-V1_09241521

Vulnerability: This is an OS command injection vulnerability (CWE-78) occurring in the networkConnect lua script. The vulnerability can be triggered by an authenticated attacker sending a specially crafted POST request to the module_get endpoint.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high severity level. Successful exploitation allows for complete system compromise, enabling attackers to execute arbitrary code with elevated privileges, which can lead to unauthorized data access, network lateral movement, or complete device incapacitation.

Remediation Plan

Immediate Action: Contact Ruijie support or monitor the official vendor portal for the release of a firmware update that patches the command injection flaw in the networkConnect module.

Proactive Monitoring: Review device access logs for unusual POST requests directed at the /usr/local/lua/dev_sta/networkConnect path.

Compensating Controls: Restrict administrative access to the device management interface to trusted internal IP addresses only, and employ a network firewall to block unauthorized traffic attempting to reach the management module.

Exploitation Status

Public Exploit Available: Yes, a technical write-up detailing the attack vector and proof-of-concept is available via the researcher's GitHub repository.

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation in the wild. The vulnerability is highly exploitable due to the lack of input sanitization in the affected script, which allows direct command execution.

Analyst Recommendation

Given the potential for full system control, organizations currently using the affected Ruijie X30-PRO firmware should isolate the device from public-facing segments immediately. Ensure that administrative credentials are complex and rotated regularly while awaiting a vendor-supplied patch. Monitor for any signs of unauthorized configuration changes or anomalous traffic patterns originating from the management interface.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-EW1800GX PRO
AFFECTED_VERSIONS: B11P226_EW1800GX-PRO_10223117
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/Eohr-0awt6VAuiLCNhCG0rgBLQip6nJpl-9Hy0OqB4MvFg?e=DIfBxi","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/EeVJ2woYmHVHn_C0Sy_iRZsB4yZQFJDXSBOwMSZW0KXJrQ?e=VVGxWb","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56097.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.798Z
---END_METADATA---

Description Summary:
A command injection vulnerability in Ruijie RG-EW1800GX PRO allows authenticated attackers to execute arbitrary system commands via a crafted POST request.

Executive Summary:
A critical OS command injection vulnerability in the Ruijie RG-EW1800GX PRO router allows authenticated attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-56097

Affected Software: Ruijie RG-EW1800GX PRO

Affected Versions: B11P226_EW1800GX-PRO_10223117

Vulnerability: The flaw exists in the module_set function within the config_retain file, where improper input sanitization allows for OS command injection. The CVSS vector PR:L indicates that an attacker must possess low-level privileges to successfully trigger this vulnerability via a crafted POST request.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the underlying operating system. This could lead to a complete loss of confidentiality, integrity, and availability of the router, potentially exposing the internal network to further lateral movement. With a CVSS score of 8.8, this represents a high-severity risk that could facilitate unauthorized access to sensitive administrative functions or internal traffic.

Remediation Plan

Immediate Action: Contact Ruijie support or monitor the official vendor security portal for firmware releases that address this command injection flaw.

Proactive Monitoring: Review device access logs for unusual POST requests directed at the module_set endpoint or suspicious system calls originating from the web management interface.

Compensating Controls: Restrict administrative access to the device management interface by implementing firewall rules that limit access to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up published on GitHub.

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation in the wild. However, the availability of a public technical write-up detailing the injection mechanism makes the risk of exploitation credible.

Analyst Recommendation

Given the potential for full system compromise, administrators should treat this vulnerability with high urgency. If a firmware update is not immediately available, restrict access to the device management interface to authorized personnel only to mitigate the risk of exploitation by malicious actors.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-BCR and RG-BCR600W
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/Evvem8Mw6SlNh-ZJpY_9SAsBq2iDi88TFdFdA1Am3PdfCQ?e=YeLYxb","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/EQ8FKwFLNjBLlL9hyg_YkUoBdsj_FcNtQsjdmKQ5M4-10A?e=bFC7Jg","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56096.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.798Z
---END_METADATA---

Description Summary:
An OS command injection vulnerability in Ruijie RG-BCR and RG-BCR600W allows authenticated attackers to execute arbitrary system commands via a crafted POST request.

Executive Summary:
A critical OS command injection flaw in Ruijie networking hardware poses a significant risk of full system compromise for affected devices.

Vulnerability Details

CVE-ID: CVE-2025-56096

Affected Software: Ruijie RG-BCR and RG-BCR600W

Affected Versions: See vendor advisory

Vulnerability: The vulnerability exists within the restart_modules function located in /usr/lib/lua/luci/controller/admin/common.lua, where improper input sanitization allows an authenticated attacker to inject and execute arbitrary OS commands.

Business Impact

The CVSS score of 8.8 indicates a high severity risk that could lead to unauthorized system access, data exfiltration, or complete loss of device control. Successful exploitation allows an attacker to gain a foothold on the network perimeter, potentially facilitating lateral movement and severe disruption to business operations.

Remediation Plan

Immediate Action: Contact Ruijie support or monitor the official vendor website to obtain and apply the latest security firmware update addressing this command injection flaw.

Proactive Monitoring: Review system access logs for unusual POST requests directed at the /usr/lib/lua/luci/controller/admin/common.lua endpoint, particularly those originating from unauthorized or suspicious administrative accounts.

Compensating Controls: Implement strict firewall rules to restrict access to the web management interface to only trusted administrative IP addresses, thereby reducing the attack surface for this authenticated vulnerability.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the research write-up referenced by the CVE record.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild, though the existence of a public proof-of-concept makes the risk credible. The command injection vector is highly dangerous due to the potential for full system-level execution.

Analyst Recommendation

Given the high CVSS severity and the availability of technical documentation regarding the exploit, administrators should treat this vulnerability with high urgency. Restrict management interface access immediately and prioritize the deployment of vendor-supplied patches as soon as they become available to prevent potential unauthorized system-level command execution.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-EW1200G PRO
AFFECTED_VERSIONS: V1.00, V2.00, V3.00, V4.00
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EkH0xWseMXBJg-Ck_uD34fcB-3pDo3MAQc2AKNlXqwYr2w?e=GU9l62","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/EQgGsVREbAJEv4dCG7LAzoYBUiS4nCjWKun_QhenDHzU0Q?e=Ly0lll","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56095.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.798Z
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the Ruijie RG-EW1200G PRO allows authenticated attackers to execute arbitrary system commands via a crafted POST request.

Executive Summary:
An OS command injection vulnerability in Ruijie RG-EW1200G PRO routers allows authenticated attackers to achieve full system compromise via malicious POST requests.

Vulnerability Details

CVE-ID: CVE-2025-56095

Affected Software: Ruijie RG-EW1200G PRO

Affected Versions: V1.00, V2.00, V3.00, V4.00

Vulnerability: The flaw exists in the module_set function within the /usr/local/lua/dev_sta/nbr_cwmp.lua file, where insufficient input sanitization allows an authenticated user to inject arbitrary system commands.

Business Impact

Successful exploitation of this vulnerability leads to full control over the affected networking hardware. Given the CVSS score of 8.8, this represents a high-severity risk that could result in total system compromise, unauthorized network traffic interception, or the use of the device as a pivot point for further attacks against the internal network.

Remediation Plan

Immediate Action: Contact Ruijie support or monitor the official vendor portal for firmware updates addressing this command injection flaw.

Proactive Monitoring: Review device access logs for unusual POST requests targeting the /usr/local/lua/dev_sta/nbr_cwmp.lua endpoint or unexpected system process spawning.

Compensating Controls: Restrict administrative access to the management interface to trusted IP addresses only and disable remote management features if they are not strictly required for operations.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up hosted on GitHub.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild. The vulnerability is highly exploitable due to the lack of input validation on the affected Lua script, which directly interfaces with the underlying operating system.

Analyst Recommendation

Organizations utilizing the affected Ruijie RG-EW1200G PRO hardware must treat this vulnerability with high priority. While an official patch status is currently unknown, administrators should immediately limit management interface exposure and remain vigilant for vendor-supplied firmware updates to remediate the underlying command injection vector.

---METADATA---
VENDOR: Ruijie
PRODUCT: X30-PRO
AFFECTED_VERSIONS: X30-PRO-V1_09241521
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EtGIxwWujwxBvQhL9wgnUIwBkg-mndJJX07Igr6d0cic-g?e=4KJbWY","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/EX8LVTGd3L9OrXvTuHDFITQBnWL-5C-CINxUmowR7vCVig?e=Quevaq","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56094.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.798Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Ruijie X30-PRO router allows authenticated attackers to execute arbitrary system commands via a crafted POST request to the module_get endpoint.

Executive Summary:
An OS command injection vulnerability in the Ruijie X30-PRO allows authenticated attackers to achieve full system compromise through malicious input to the host_access_delay module.

Vulnerability Details

CVE-ID: CVE-2025-56094

Affected Software: Ruijie X30-PRO

Affected Versions: X30-PRO-V1_09241521

Vulnerability: This vulnerability is an OS command injection flaw located in the /usr/local/lua/dev_sta/host_access_delay.lua file. It requires the attacker to have low-level privileges to send a crafted POST request to the module_get endpoint, resulting in arbitrary command execution on the underlying operating system.

Business Impact

The ability to execute arbitrary commands on network infrastructure presents a severe risk to organizational security. Successful exploitation grants an attacker full control over the affected router, potentially leading to unauthorized network access, data interception, and the redirection of traffic. With a CVSS score of 8.8, this high-severity flaw represents a critical threat to internal network integrity and availability.

Remediation Plan

Immediate Action: Contact the vendor immediately to obtain the appropriate firmware update for the X30-PRO-V1_09241521 version, as no public patch is currently confirmed.

Proactive Monitoring: Review system and access logs for suspicious POST requests directed at the host_access_delay module or irregular administrative activity.

Compensating Controls: Restrict management access to the device to trusted IP addresses only and ensure that the administrative interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the researcher's report on GitHub.

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation in the wild. The vulnerability is highly exploitable due to the lack of input sanitization in the affected Lua script, which directly passes user input to system calls.

Analyst Recommendation

Given the severity of this command injection vulnerability, organizations using the Ruijie X30-PRO should treat this as a high priority. Until a formal vendor patch is verified and applied, administrators must restrict access to the device management interface to minimize the attack surface. Monitor for any unauthorized configuration changes or unexpected device behavior that could indicate exploitation.

---METADATA---
VENDOR: Ruijie
PRODUCT: X30-PRO
AFFECTED_VERSIONS: X30-PRO-V1_09241521
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EtGIxwWujwxBvQhL9wgnUIwBkg-mndJJX07Igr6d0cic-g?e=4KJbWY","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/Edoz9sBTjeJMqw8K0f3lWgMBNxBlpE9IIUwOX2h2S1cMhw?e=46VlOq","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56092.md","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56093.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.798Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Ruijie X30-PRO router allows authenticated attackers to execute arbitrary system commands via a crafted POST request to the setWisp function.

Executive Summary:
A critical OS command injection vulnerability in the Ruijie X30-PRO router enables authenticated attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-56093

Affected Software: Ruijie X30-PRO

Affected Versions: X30-PRO-V1_09241521

Vulnerability: This is an OS command injection flaw located in the setWisp function within the wireless module. Successful exploitation requires a low-privileged authenticated user to send a specially crafted POST request, which then executes arbitrary commands with system level privileges.

Business Impact

The ability to execute arbitrary commands on network infrastructure poses a severe threat to organizational security. An attacker could leverage this vulnerability to gain full control over the router, intercept sensitive network traffic, pivot into internal segments, or render the device inoperable, causing significant operational downtime. With a CVSS score of 8.8, this flaw represents a high-risk entry point for lateral movement within the network.

Remediation Plan

Immediate Action: Contact Ruijie support or check the official vendor portal for firmware updates addressing this command injection vulnerability. If no patch is currently available, restrict management access to the device to trusted administrative IP addresses only.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the wireless configuration modules. Alert on any unexpected shell process execution or anomalous outbound traffic originating from the router management interface.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System to inspect and block malicious POST requests containing shell metacharacters directed at the setWisp endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists (referenced in the GitHub repository provided by the vulnerability reporter).

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild, but the existence of a public proof-of-concept repository renders the risk of exploitation credible. The reliance on authenticated access does not significantly lower the risk, as compromised user credentials are a common vector for network appliance attacks.

Analyst Recommendation

Given the high CVSS score and the public availability of technical details regarding the injection vector, this vulnerability should be prioritized for remediation. IT administrators must ensure that administrative access to the Ruijie X30-PRO is strictly controlled and that firmware is updated as soon as a vendor-supplied security patch is released.

---METADATA---
VENDOR: Ruijie
PRODUCT: X30 PRO
AFFECTED_VERSIONS: X30-PRO-V1_09241521
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EtGIxwWujwxBvQhL9wgnUIwBkg-mndJJX07Igr6d0cic-g?e=4KJbWY","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/EaD98URfTfFKm1v_MTfU-UEBUxRf5vj3O0x7fhabn5_l9A?e=BuNPV9","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56091.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.802Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Ruijie X30 PRO allows authenticated attackers to execute arbitrary commands via a crafted POST request to the networkConnect module.

Executive Summary:
An OS command injection flaw in the Ruijie X30 PRO firmware poses a high risk of complete system compromise to affected network infrastructure.

Vulnerability Details

CVE-ID: CVE-2025-56092

Affected Software: Ruijie X30 PRO

Affected Versions: X30-PRO-V1_09241521

Vulnerability: The device suffers from an OS command injection vulnerability triggered by sending a malicious POST request to the module_get endpoint within the networkConnect.lua file. Per the CVSS vector (PR:L), this vulnerability requires the attacker to have low-level privileges on the device to successfully execute commands.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the underlying operating system. This could lead to a full device takeover, unauthorized access to sensitive network traffic, or the use of the device as a pivot point for further lateral movement within the corporate network. With a CVSS score of 8.8, this vulnerability represents a high-severity threat that necessitates immediate attention to prevent operational disruption and data exfiltration.

Remediation Plan

Immediate Action: Contact the vendor or check the official Ruijie support portal for firmware updates addressing this specific command injection vulnerability, as no public patch is currently confirmed.

Proactive Monitoring: Review system access logs for anomalous POST requests directed at the networkConnect module and monitor for unexpected outbound traffic from the device.

Compensating Controls: Restrict administrative access to the device management interface to trusted internal segments and deploy WAF rules to sanitize or block POST requests containing shell metacharacters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation is not currently observed, the nature of command injection flaws makes them highly dangerous if an attacker gains initial access to the management interface.

Analyst Recommendation

Given the potential for complete system compromise, administrators should prioritize securing management interfaces and restricting access to authorized personnel only. Until a vendor-supplied patch is verified and applied, strict network segmentation and monitoring are essential to mitigate the risk of unauthorized command execution on the affected Ruijie hardware.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-EW1800GX
AFFECTED_VERSIONS: B11P226_EW1800GX_10223121
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/t/c/12406a392c92914b/EdiWfxSbC0pAu_oksKjm2xgBXSCavYBBJt8V51JkcH4Dsw?e=OhOVCN","name":null,"tags":[]},{"url":"https://1drv.ms/f/c/12406a392c92914b/EgUg1zJuaItDmLxZhkCg4B8BcJTRYnXyX4ePIIjNoZrRew?e=a23cK6","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56091.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.802Z
---END_METADATA---

Description Summary:
A command injection vulnerability in Ruijie RG-EW1800GX allows authenticated attackers to execute arbitrary system commands via a crafted POST request to the module_set endpoint.

Executive Summary:
An OS command injection vulnerability in the Ruijie RG-EW1800GX router allows authenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-56091

Affected Software: Ruijie RG-EW1800GX

Affected Versions: B11P226_EW1800GX_10223121

Vulnerability: This is an OS command injection flaw located in the /usr/local/lua/dev_config/config_retain.lua file, which fails to properly sanitize input provided to the module_set function. The CVSS vector (PR:L) indicates that the attacker must possess low-level administrative or user credentials to trigger this vulnerability.

Business Impact

The ability to execute arbitrary commands on network infrastructure poses a severe risk to organizational security, potentially allowing an attacker to intercept traffic, pivot into internal network segments, or permanently disable critical connectivity. With a CVSS score of 8.8, this vulnerability is classified as High, representing a significant threat to confidentiality, integrity, and availability of the affected device.

Remediation Plan

Immediate Action: Restrict access to the management interface to trusted administrative IP addresses only, and contact the vendor to obtain the necessary firmware update to resolve the command injection flaw.

Proactive Monitoring: Monitor device access logs for suspicious POST requests targeting the module_set endpoint and investigate any unauthorized configuration changes or unexpected outbound network traffic from the router.

Compensating Controls: Implement a Web Application Firewall or network-level access control list to block unauthorized access to the router management interface, effectively limiting the attack surface.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the security researcher's report on GitHub.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild; however, the availability of a public proof-of-concept increases the likelihood of exploitation, and the flaw should be treated as a high-priority risk.

Analyst Recommendation

Given the potential for complete device compromise and the availability of technical details regarding the exploit, administrators should prioritize securing the management interface of the affected Ruijie hardware. Apply vendor-provided patches as soon as they become available and ensure that administrative access is restricted to authorized personnel only to mitigate the risk of unauthorized command execution.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-EW1200G PRO
AFFECTED_VERSIONS: V1.00, V2.00, V3.00, V4.00
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/t/c/12406a392c92914b/EfSHWqE3N11FpgQsV1BlZk0BxXIhFQjIp_xmJYIq1APvrw?e=JCIm6k","name":null,"tags":[]},{"url":"https://1drv.ms/f/c/12406a392c92914b/EkH0xWseMXBJg-Ck_uD34fcB-3pDo3MAQc2AKNlXqwYr2w?e=GU9l62","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56090.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.802Z
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the Ruijie RG-EW1200G PRO allows authenticated attackers to execute arbitrary system commands via a crafted POST request to a specific Lua configuration file.

Executive Summary:
An OS command injection vulnerability in Ruijie RG-EW1200G PRO firmware poses a severe risk of full system compromise for affected routers.

Vulnerability Details

CVE-ID: CVE-2025-56090

Affected Software: Ruijie RG-EW1200G PRO

Affected Versions: V1.00, V2.00, V3.00, V4.00

Vulnerability: The flaw exists in the file /usr/local/lua/dev_config/config_retain.lua, where improper sanitization of input allows an authenticated attacker to inject and execute arbitrary OS commands via the module_set parameter. The CVSS vector (PR:L) indicates that the attacker must possess valid user credentials to trigger this vulnerability.

Business Impact

Successful exploitation allows for complete control over the network device, which can be leveraged to intercept traffic, pivot into internal network segments, or facilitate further attacks. With a CVSS score of 8.8, this high-severity vulnerability represents a significant threat to organizational data confidentiality, integrity, and operational availability.

Remediation Plan

Immediate Action: Restrict administrative access to the device management interface to trusted internal segments only and monitor for vendor-provided firmware updates that address this command injection flaw.

Proactive Monitoring: Review device access logs for unusual POST requests directed at /usr/local/lua/dev_config/config_retain.lua or unexpected system calls originating from the web management service.

Compensating Controls: Implement strict firewall rules to ensure the device management interface is not exposed to the public internet, thereby reducing the attack surface for unauthorized or compromised accounts.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research repository hosted on GitHub.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild, though the existence of a public proof-of-concept makes the risk of exploitation credible. The vulnerability is inherently dangerous because it provides a direct path from an authenticated session to full shell-level command execution on the underlying operating system.

Analyst Recommendation

Given the high CVSS score and the existence of a public proof-of-concept, users of the Ruijie RG-EW1200G PRO should treat this vulnerability with high urgency. Administrators must isolate the device management interface and prepare to apply security patches as soon as the vendor releases them to prevent potential lateral movement within the network.

---METADATA---
VENDOR: Ruijie
PRODUCT: M18 EW_3
AFFECTED_VERSIONS: M18 EW_3.0(1)B11P226_M18_10223116
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/t/c/12406a392c92914b/Ea56irtVj4dNs59Pzz7fkiIBQeVLjDcMDEXC2FpCQydIZQ?e=70gcOe","name":null,"tags":[]},{"url":"https://1drv.ms/f/c/12406a392c92914b/EmXarTTNPwFHjk8lLwQIqj8Ba9nlq-owLMBtEKpBwMrn5A?e=vvi2dM","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56089.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.802Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Ruijie M18 EW_3 router allows authenticated attackers to execute arbitrary system commands via a crafted POST request.

Executive Summary:
A critical OS command injection vulnerability exists in the Ruijie M18 EW_3 device, which could allow an authenticated attacker to gain full control over the affected hardware.

Vulnerability Details

CVE-ID: CVE-2025-56089

Affected Software: Ruijie M18 EW_3

Affected Versions: M18 EW_3.0(1)B11P226_M18_10223116

Vulnerability: This is an OS command injection flaw located within the module_set function of the file /usr/local/lua/dev_sta/nbr_cwmp.lua. The vulnerability requires the attacker to have low-level privileges to submit a crafted POST request that triggers arbitrary command execution.

Business Impact

The ability to execute arbitrary OS commands poses a severe risk to network security, as it allows for complete system compromise, potential data exfiltration, and the ability to use the device as a pivot point for further lateral movement within the network. With a CVSS score of 8.8, this vulnerability is classified as High severity and necessitates immediate attention to prevent unauthorized administrative access and potential service disruption.

Remediation Plan

Immediate Action: Since no official patch is currently identified, restrict access to the device management interface to trusted internal segments only and monitor for suspicious POST requests targeting the identified Lua script.

Proactive Monitoring: Review device access logs for unauthorized attempts to access /usr/local/lua/dev_sta/nbr_cwmp.lua and monitor for unexpected outbound traffic or anomalous process execution on the router.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block POST requests containing shell metacharacters or suspicious payloads directed at the vulnerable module_set endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research report hosted on GitHub.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild; however, the availability of a public proof-of-concept makes the exploitation risk credible. The vulnerability is inherently dangerous because it allows direct interaction with the underlying operating system shell.

Analyst Recommendation

Given the potential for full system compromise, administrators should treat this vulnerability with extreme urgency. Even in the absence of an official vendor patch, immediate network segmentation and strict access control for the management interface are required to minimize the attack surface. Organizations should continue to monitor vendor communication channels for the release of a firmware update that addresses the identified command injection flaw.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-BCR860
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EqEQemupso9DldgG-EcUI8IBLpEWP_S-f6vpeUtYztYYCg?e=gX4A10","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/EQ5pK82-KmxKht6YgsEzaOsBzrC05Cael1vwpfM9ZxX97Q?e=qEgmtB","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56088.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.802Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Ruijie RG-BCR860 allows authenticated attackers to execute arbitrary system commands via crafted POST requests to the action_service endpoint.

Executive Summary:
An OS command injection vulnerability in Ruijie RG-BCR860 devices poses a critical risk of full system compromise for organizations utilizing this hardware.

Vulnerability Details

CVE-ID: CVE-2025-56088

Affected Software: Ruijie RG-BCR860

Affected Versions: See vendor advisory

Vulnerability: The flaw exists in the action_service file located at /usr/lib/lua/luci/controller/admin/service.lua, where improper input validation allows an authenticated user to perform OS command injection. This vulnerability requires low privileges to execute, as indicated by the CVSS vector PR:L.

Business Impact

The ability to execute arbitrary commands on network infrastructure equipment can lead to a complete loss of confidentiality, integrity, and availability. With a CVSS score of 8.8, this vulnerability represents a high-severity risk that could allow an attacker to pivot into internal networks, intercept traffic, or disable security controls, resulting in significant operational disruption and potential data breaches.

Remediation Plan

Immediate Action: Contact Ruijie support or monitor the official vendor security portal to identify and apply the necessary firmware updates as soon as they become available.

Proactive Monitoring: Review device access logs for unusual POST requests directed at the action_service endpoint and monitor for unexpected outbound network connections originating from the device.

Compensating Controls: Implement strict network access control lists (ACLs) to limit management interface access to trusted administrative IP addresses only, effectively reducing the attack surface.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the research write-up referenced by the CVE record.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild. However, because the vulnerability is documented via a public research write-up on GitHub, the risk of exploitation by malicious actors is considered elevated and credible.

Analyst Recommendation

The severity of this command injection vulnerability necessitates immediate attention from network administrators. Organizations should prioritize restricting administrative access to the affected devices while awaiting official firmware patches from the vendor. Once a fix is released, it should be tested and deployed across the environment without delay to prevent unauthorized system access.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-BCR and RG-BCR600W
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/Evvem8Mw6SlNh-ZJpY_9SAsBq2iDi88TFdFdA1Am3PdfCQ?e=YeLYxb","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/Echt6Ult6oNBv8c0GnssJeEBmbJbPx8enDixRCuyiWcKsw?e=2zJ5I2","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56087.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.802Z
---END_METADATA---

Description Summary:
A command injection vulnerability in Ruijie network devices allows authenticated attackers to execute arbitrary system commands via a malicious POST request to the tcpdump utility.

Executive Summary:
An OS command injection vulnerability in Ruijie RG-BCR and RG-BCR600W devices poses a high risk of total system compromise for organizations using the affected hardware.

Vulnerability Details

CVE-ID: CVE-2025-56087

Affected Software: Ruijie RG-BCR and RG-BCR600W

Affected Versions: See vendor advisory

Vulnerability: The vulnerability is an OS command injection flaw located in the run_tcpdump function within the Lua controller files. An attacker with low privileges (authenticated user) can inject arbitrary system commands into the device through a crafted POST request.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with the privileges of the web service, which typically results in full system control. Given the CVSS score of 8.8, this represents a high-severity threat that could lead to complete data exfiltration, service disruption, or the use of the device as a pivot point for further lateral movement within the internal network.

Remediation Plan

Immediate Action: Contact Ruijie support or monitor the official vendor security portal to identify and apply the necessary firmware updates or patches as soon as they are made available.

Proactive Monitoring: Review device access logs for suspicious POST requests targeting the common_tcpdump file or unusual execution patterns originating from authenticated user accounts.

Compensating Controls: Restrict management interface access to trusted administrative IP addresses and employ a Web Application Firewall (WAF) to inspect and block anomalous traffic patterns attempting to access the vulnerable Lua controller.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the security researcher's report on GitHub.

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation in the wild, though the availability of a public proof-of-concept necessitates prompt attention. The flaw is inherently dangerous due to the direct execution of system commands without sufficient input sanitization.

Analyst Recommendation

This vulnerability presents a significant security risk due to the potential for remote command execution on critical network infrastructure. Security teams should prioritize identifying affected devices in their environment and maintain a state of high alert until a vendor-supplied patch is applied. Immediate implementation of network-level access controls is strongly recommended to minimize the attack surface.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-EW1200
AFFECTED_VERSIONS: EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/f/c/12406a392c92914b/EuESCSUsYvtAtfW1SfmGGxsBw-kN9iCbpnUU9T8TXofH3w?e=kp5OXK","name":null,"tags":[]},{"url":"https://1drv.ms/t/c/12406a392c92914b/ETgTxS2wFBlCjG4DP56-PjkBWwvraLHZ-BVaWh9Vs9_SuA?e=aTbjEe","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56086.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.802Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Ruijie RG-EW1200 router allows authenticated attackers to execute arbitrary system commands via a crafted POST request to the networkConnect.lua module.

Executive Summary:
An OS command injection vulnerability in the Ruijie RG-EW1200 router allows an authenticated attacker to achieve full remote code execution on the affected device.

Vulnerability Details

CVE-ID: CVE-2025-56086

Affected Software: Ruijie RG-EW1200

Affected Versions: EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00

Vulnerability: The vulnerability exists due to improper neutralization of special elements used in an OS command within the module_get function, specifically in the file /usr/local/lua/dev_sta/networkConnect.lua. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates that an attacker must possess low-level privileges to perform the attack, which is triggered via a crafted POST request.

Business Impact

The ability to execute arbitrary OS commands presents a critical risk, as it allows an attacker to gain complete control over the network device. This can lead to total system compromise, unauthorized access to internal network traffic, and potential lateral movement into the broader corporate environment. With a CVSS score of 8.8, this vulnerability is classified as High severity due to the high impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Contact Ruijie support or check the official vendor portal for firmware updates addressing this command injection flaw, as no public patch is currently confirmed.

Proactive Monitoring: Monitor device access logs for suspicious POST requests targeting the /usr/local/lua/dev_sta/networkConnect.lua endpoint.

Compensating Controls: Restrict administrative access to the management interface to trusted IP addresses only and ensure that the device is not exposed directly to the public internet.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research repository provided by the vulnerability reporter.

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation of this vulnerability in the wild. However, the availability of a published proof-of-concept necessitates prompt attention to securing the management interface of affected units.

Analyst Recommendation

Given the potential for complete system compromise and the existence of a public proof-of-concept, users of the Ruijie RG-EW1200 should prioritize securing their devices immediately. Administrators are urged to restrict access to the device management interface and maintain close contact with the vendor for official firmware updates to remediate this injection flaw.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-EW1200
AFFECTED_VERSIONS: EW_3.0(1)B11P227_EW1200_11130208 and V1.00
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/t/c/12406a392c92914b/ERuoK3MLW2RLpQ6qOoGs5wIB73tNnsDzRT8U6U6z4VmskQ?e=KIjaOa","name":null,"tags":[]},{"url":"https://1drv.ms/f/c/12406a392c92914b/EuESCSUsYvtAtfW1SfmGGxsBw-kN9iCbpnUU9T8TXofH3w?e=kp5OXK","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56085.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.802Z
---END_METADATA---

Description Summary:
A command injection vulnerability in Ruijie RG-EW1200 allows authenticated attackers to execute arbitrary system commands via the module_set parameter in the config_retain.lua file.

Executive Summary:
An OS command injection vulnerability in Ruijie RG-EW1200 devices allows authenticated attackers to gain full system control, posing a significant risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2025-56085

Affected Software: Ruijie RG-EW1200

Affected Versions: EW_3.0(1)B11P227_EW1200_11130208 and V1.00

Vulnerability: This is an OS command injection flaw located in the /usr/local/lua/dev_config/config_retain.lua script. By sending a crafted POST request to the module_set endpoint, an authenticated attacker can execute arbitrary commands on the underlying operating system.

Business Impact

The ability to execute arbitrary commands on network infrastructure equipment can lead to a complete compromise of the device. Given the CVSS score of 8.8, this vulnerability represents a high severity risk that could result in unauthorized lateral movement, data exfiltration, or the establishment of persistent backdoors within the network environment.

Remediation Plan

Immediate Action: Contact the vendor immediately to obtain firmware updates that address this injection vulnerability, as no public patch is currently confirmed.

Proactive Monitoring: Monitor device traffic and system logs for suspicious POST requests targeting the config_retain.lua path or unusual shell execution patterns.

Compensating Controls: Implement strict network access control lists to limit management interface access to trusted administrative IP addresses only, reducing the attack surface for potential exploitation.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the researcher's technical write-up on GitHub.

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation in the wild, but the availability of a published technical write-up and proof-of-concept makes the risk of exploitation credible. The vulnerability is inherently dangerous because it allows direct interaction with the system shell from a web-based interface.

Analyst Recommendation

The high severity of this command injection vulnerability necessitates prompt attention from network administrators. Until a vendor-supplied firmware update is verified and applied, isolate affected RG-EW1200 devices from public-facing networks and restrict administrative access to the management interface to prevent unauthorized exploitation by authenticated users.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-EW1800GX PRO
AFFECTED_VERSIONS: B11P226_EW1800GX-PRO_10223117
CONFIDENCE: high
MISSING: patch, exploit_status
SOURCES_JSON: [{"url":"https://1drv.ms/t/c/12406a392c92914b/EdfdfnvOxAhJqdeIGlRRo6ABHJz03PPPBYIMdLoD6iNhlg?e=qNhi6o","name":null,"tags":[]},{"url":"https://1drv.ms/f/c/12406a392c92914b/Eohr-0awt6VAuiLCNhCG0rgBLQip6nJpl-9Hy0OqB4MvFg?e=DIfBxi","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56084.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.802Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Ruijie RG-EW1800GX PRO allows authenticated attackers to execute arbitrary system commands via a crafted POST request to the module_set endpoint.

Executive Summary:
An OS command injection vulnerability in the Ruijie RG-EW1800GX PRO allows authenticated attackers to achieve full system compromise through crafted network requests.

Vulnerability Details

CVE-ID: CVE-2025-56084

Affected Software: Ruijie RG-EW1800GX PRO

Affected Versions: B11P226_EW1800GX-PRO_10223117

Vulnerability: This is an OS command injection flaw located in the nbr_cwmp.lua file. It allows an attacker with low-level privileges to inject and execute arbitrary system commands by sending a malicious POST request to the module_set function.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands with the privileges of the underlying service. This poses a severe risk to business operations, as it could lead to full device takeover, lateral movement within the network, or the exfiltration of sensitive configuration data. With a CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized access.

Remediation Plan

Immediate Action: Contact Ruijie support or monitor official security channels for a firmware update that addresses the command injection in the nbr_cwmp.lua module.

Proactive Monitoring: Review system and web access logs for suspicious POST requests directed at the module_set endpoint, specifically looking for shell metacharacters or unexpected command strings.

Compensating Controls: Implement strict network access controls to limit the number of users who can reach the management interface, and utilize a Web Application Firewall to block requests containing anomalous payloads.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research repository provided by the vulnerability reporter.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild. However, given the availability of a public proof-of-concept, the risk of exploitation is elevated and should be treated as credible. The flaw is inherently dangerous due to the ease of injecting commands through the exposed management endpoint.

Analyst Recommendation

Given the High severity of this command injection vulnerability, organizations using the affected Ruijie hardware must prioritize the identification and isolation of these devices. Until an official vendor patch is released and verified, administrators should restrict network access to the device management interface to trusted administrative subnets only. Prompt application of the security update is essential once available to mitigate the risk of unauthorized system-level code execution.

---METADATA---
VENDOR: Ruijie
PRODUCT: X30-PRO
AFFECTED_VERSIONS: X30-PRO-V1_09241521
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/t/c/12406a392c92914b/EciYj-O9Oi1PgNsZdTao0iwBub3gdfqA3safE0A4I9foYg?e=Mi39JB","name":null,"tags":[]},{"url":"https://1drv.ms/f/c/12406a392c92914b/EtGIxwWujwxBvQhL9wgnUIwBkg-mndJJX07Igr6d0cic-g?e=4KJbWY","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56083.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.802Z
---END_METADATA---

Description Summary:
An OS command injection vulnerability in Ruijie X30-PRO allows authenticated attackers to execute arbitrary system commands via a crafted POST request to the module_set endpoint.

Executive Summary:
A critical OS command injection vulnerability in the Ruijie X30-PRO router allows authenticated attackers to execute arbitrary commands, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-56083

Affected Software: Ruijie X30-PRO

Affected Versions: X30-PRO-V1_09241521

Vulnerability: The flaw exists due to improper input sanitization in the module_set function within the file /usr/local/lua/dev_sta/nbr_networkId_merge.lua, which permits authenticated users to inject and execute OS commands.

Business Impact

Successful exploitation allows an attacker to gain unauthorized control over the affected network device. Given the CVSS score of 8.8, this vulnerability poses a high risk to business operations, as it could lead to complete device takeover, lateral movement within the network, and potential data exfiltration.

Remediation Plan

Immediate Action: Contact the vendor immediately to obtain the latest firmware update for the X30-PRO, as no public patch is currently confirmed.

Proactive Monitoring: Inspect system logs for suspicious POST requests targeting the /usr/local/lua/dev_sta/nbr_networkId_merge.lua endpoint or unusual shell execution patterns.

Compensating Controls: Restrict administrative access to the device management interface to trusted IP addresses only and implement WAF rules to filter malicious payloads in POST requests.

Exploitation Status

Public Exploit Available: Yes — a public proof of concept is available via the researcher report hosted on GitHub.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild. The existence of a published proof of concept on GitHub indicates that the technical barrier to exploitation is low, necessitating prompt attention.

Analyst Recommendation

Due to the severity of this command injection flaw and the availability of a public proof of concept, administrators should prioritize the restriction of management interfaces. Verify current firmware versions against the latest vendor releases and apply all security updates as soon as they become available to neutralize this high risk vector.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-BCR and RG-BCR600W
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
SOURCES_JSON: [{"url":"https://1drv.ms/t/c/12406a392c92914b/EfCFw0RRV0hJvpV0rBLvTvABtWGVbrHzIPwPyku7phQ3Dg?e=GMqLpV","name":null,"tags":[]},{"url":"https://1drv.ms/f/c/12406a392c92914b/Evvem8Mw6SlNh-ZJpY_9SAsBq2iDi88TFdFdA1Am3PdfCQ?e=YeLYxb","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56082.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.802Z
---END_METADATA---

Description Summary:
A command injection vulnerability in Ruijie RG-BCR devices allows authenticated attackers to execute arbitrary system commands via a crafted POST request to the check_changes endpoint.

Executive Summary:
A critical OS command injection vulnerability in Ruijie RG-BCR and RG-BCR600W devices allows authenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-56082

Affected Software: Ruijie RG-BCR and RG-BCR600W

Affected Versions: See vendor advisory

Vulnerability: This vulnerability is an OS command injection flaw located within the check_changes function in the Lua controller file. It requires an authenticated user with low privileges to trigger the execution of arbitrary commands on the underlying operating system.

Business Impact

The ability to execute arbitrary commands on network infrastructure equipment poses a severe risk to organizational security. Successful exploitation could lead to total system takeover, unauthorized access to internal network traffic, and potential persistence for lateral movement. The CVSS score of 8.8 reflects the high severity of this vulnerability, as it allows for complete confidentiality, integrity, and availability impact if exploited.

Remediation Plan

Immediate Action: Contact Ruijie support or monitor the official vendor security portal to identify and apply the necessary firmware updates as soon as they become available.

Proactive Monitoring: Review administrative access logs for unusual POST requests directed at the check_changes endpoint or unexpected shell activity originating from the device.

Compensating Controls: Restrict management access to these devices to trusted administrative subnets and implement strict firewall rules to limit exposure of the management interface.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the research repository hosted on GitHub.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild. However, a functional proof-of-concept has been published, which significantly lowers the barrier for potential attackers to weaponize this vulnerability.

Analyst Recommendation

Given the capability for remote code execution on core network hardware, this vulnerability must be treated with high urgency. Administrators should prioritize identifying vulnerable devices within their environment and apply vendor-supplied patches immediately upon release to prevent potential exploitation of the command injection flaw.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-EW1300G
AFFECTED_VERSIONS: V1.00, V2.00, V4.00
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://1drv.ms/t/c/12406a392c92914b/EZdYNxRd8ilMrCRXLnltUKEBiBXJzrTc9i7Y643cuho9PA?e=7Bifxw","name":null,"tags":[]},{"url":"https://1drv.ms/f/c/12406a392c92914b/EjGDN1e4xfZOhROI3hzjKr0Bb9TVCN03MAR_VK56P8V3Ug?e=NmUXvt","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56079.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.806Z
---END_METADATA---

Description Summary:
A command injection vulnerability in Ruijie RG-EW1300G allows authenticated attackers to execute arbitrary commands via a crafted POST request to the networkConnect.lua module.

Executive Summary:
An OS command injection vulnerability in the Ruijie RG-EW1300G router poses a critical risk by allowing authenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2025-56079

Affected Software: Ruijie RG-EW1300G

Affected Versions: V1.00, V2.00, V4.00

Vulnerability: The flaw exists within the /usr/local/lua/dev_sta/networkConnect.lua file, where insufficient input validation allows an authenticated user to inject malicious commands into the module_get parameter.

Business Impact

Successful exploitation allows an attacker to achieve full system compromise by executing arbitrary code with high privileges. This could lead to unauthorized network access, data exfiltration, or complete device takeover, which justifies the high CVSS score of 8.8. Such an incident poses a significant threat to internal network integrity and overall business continuity.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified, users should restrict administrative access to the device management interface to trusted personnel only and monitor for suspicious activity.

Proactive Monitoring: Review system logs for unusual POST requests directed at the networkConnect.lua endpoint and monitor for unexpected outbound traffic from the device.

Compensating Controls: Implement a Web Application Firewall (WAF) or network-level access control list (ACL) to block unauthorized attempts to reach the vulnerable Lua script endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as detailed in the GitHub repository cited in the vulnerability references.

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation in the wild. The existence of a public proof-of-concept makes this vulnerability highly actionable for threat actors, requiring immediate mitigation steps to prevent potential abuse.

Analyst Recommendation

Given the potential for remote code execution and the availability of public exploit documentation, this vulnerability should be treated with high priority. Organizations utilizing the affected Ruijie hardware must restrict management interface access and maintain a strict posture until the vendor releases a definitive firmware update to resolve the injection flaw.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-RAP2200(E)
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: medium
MISSING: versions, patch
SOURCES_JSON: [{"url":"https://1drv.ms/t/c/12406a392c92914b/EURTWAoIJNRMtvzNPi08CToB780nsKPNHZ2Fdmcf9xsoRA?e=jHygdj","name":null,"tags":[]},{"url":"https://1drv.ms/f/c/12406a392c92914b/EvnzTspA23NAl-T9w70dG4MBnWWojsrzAeM1i-ed2EauAA?e=AYOxPM","name":null,"tags":[]},{"url":"https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56077.md","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:46.806Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Ruijie RG-RAP2200(E) allows authenticated attackers to execute arbitrary system commands via a crafted POST request.

Executive Summary:
An OS command injection vulnerability in the Ruijie RG-RAP2200(E) series allows authenticated attackers to execute arbitrary system commands, posing a significant risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-56077

Affected Software: Ruijie RG-RAP2200(E)

Affected Versions: See vendor advisory

Vulnerability: This vulnerability is an OS command injection flaw located in the module_set function within the file /usr/local/lua/dev_sta/nbr_cwmp.lua. According to the CVSS vector (PR:L), the attack requires a low level of authentication to trigger.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected device, potentially leading to a complete loss of confidentiality, integrity, and availability. With a CVSS score of 8.8, this flaw represents a high-severity risk that could lead to unauthorized network access or the use of compromised devices as pivot points within the internal infrastructure.

Remediation Plan

Immediate Action: Contact Ruijie support or monitor the official vendor security portal for the release of a firmware update that patches the vulnerable module.

Proactive Monitoring: Review web server access logs for suspicious POST requests directed at the /usr/local/lua/dev_sta/nbr_cwmp.lua endpoint.

Compensating Controls: Restrict access to the device management interface to trusted administrative IP addresses only, and implement a Web Application Firewall (WAF) to filter malicious POST payloads.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the research report linked via the GitHub reference provided in the CVE record.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild. However, given the availability of technical details and a proof-of-concept in the public domain, the risk of exploitation is elevated and warrants immediate attention.

Analyst Recommendation

Given the high CVSS score and the presence of public technical details, organizations using the Ruijie RG-RAP2200(E) should prioritize this vulnerability. Administrators must verify their current firmware versions and apply the vendor-provided patch as soon as it becomes available to prevent potential remote command execution.

---METADATA---
VENDOR: Ruijie
PRODUCT: Switch eWeb S29_RGOS
AFFECTED_VERSIONS: eWeb S29_RGOS 11.4(1)B12P11
CONFIDENCE: high
MISSING: none
CREDITS: Tuygun (finder)
SOURCES_JSON: [{"url":"https://www.exploit-db.com/exploits/48755","name":"ExploitDB-48755","tags":["exploit"]},{"url":"https://www.ruijienetworks.com/","name":"Ruijie Networks Official Homepage","tags":["product"]},{"url":"https://faruktuygun.com/directorytraversal.html","name":"Directory Traversal Vulnerability Source","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/ruijie-networks-switch-eweb-srgos-directory-traversal","name":"VulnCheck Advisory: Ruijie Networks Switch eWeb S29_RGOS 11.4 - Directory Traversal","tags":["third-party-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:43.542Z
---END_METADATA---

Description Summary:
A directory traversal vulnerability in the Ruijie Networks Switch eWeb S29_RGOS web interface allows unauthenticated attackers to retrieve sensitive system configuration files via path manipulation.

Executive Summary:
A directory traversal vulnerability in Ruijie Networks switches allows unauthenticated attackers to exfiltrate sensitive configuration files, including plaintext credentials, posing a severe security risk.

Vulnerability Details

CVE-ID: CVE-2020-37015

Affected Software: Ruijie Switch eWeb S29_RGOS

Affected Versions: eWeb S29_RGOS 11.4(1)B12P11

Vulnerability: The application is susceptible to a path traversal flaw in the /download.do endpoint. By injecting directory traversal sequences into the file parameter, an unauthenticated attacker can bypass access controls to read arbitrary files from the underlying filesystem.

Business Impact

The ability for an unauthenticated attacker to retrieve configuration files directly leads to the exposure of administrative credentials, network topology information, and system settings. This unauthorized access compromises the confidentiality of the network infrastructure, potentially facilitating lateral movement or full device takeover. With a CVSS score of 7.5, this high-severity vulnerability represents a significant threat to internal network integrity.

Remediation Plan

Immediate Action: Update the affected Ruijie switch firmware to the latest version provided by the vendor that addresses this directory traversal flaw.

Proactive Monitoring: Review device access logs for suspicious GET requests targeting the /download.do endpoint, specifically looking for sequences containing ../ or other path traversal patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize requests containing directory traversal sequences (such as ../) directed at the web management interface.

Exploitation Status

Public Exploit Available: Yes, a functional exploit is available via the Exploit-DB entry 48755.

Analyst Notes: As of January 31, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently trivial to exploit, requiring only a single crafted HTTP request to extract sensitive data.

Analyst Recommendation

Given the availability of public exploit code and the high potential for credential theft, organizations using Ruijie S29_RGOS switches must prioritize patching. If an immediate update is not feasible, ensure that the management interface is not exposed to the public internet and restrict access to authorized management segments only.