Cyber Posture

CVE-2025-56083

High

Published: 11 December 2025

Published
11 December 2025
Modified
11 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0047 64.6th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_networkId_merge.lua.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents OS command injection by validating and sanitizing crafted POST request inputs to the module_set function in nbr_networkId_merge.lua.

SI-9 Information Input Restrictions good match
prevent

Enforces restrictions on POST request parameters to block injection of shell metacharacters or malformed data targeting the vulnerable Lua endpoint.

SI-2 Flaw Remediation good match
prevent

Remediates the specific OS command injection flaw in Ruijie X30-PRO V1_09241521 firmware through timely flaw identification, patching, and testing.

Security SummaryAI

CVE-2025-56083 is an OS Command Injection vulnerability (CWE-78) in the Ruijie X30-PRO device, specifically version X30-PRO-V1_09241521. The issue affects the module_set function in the file /usr/local/lua/dev_sta/nbr_networkId_merge.lua, enabling attackers to execute arbitrary operating system commands via a crafted POST request. Published on 2025-12-11T18:16:20.420, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

The vulnerability can be exploited remotely by attackers with low privileges (PR:L), requiring low attack complexity and no user interaction. Exploitation occurs over the network through a specially crafted POST request to the vulnerable endpoint, granting attackers high-level access to execute arbitrary OS commands and compromise confidentiality, integrity, and availability.

Advisories and detailed reports on this vulnerability, including potential exploitation details, are available at the following references: https://1drv.ms/f/c/12406a392c92914b/EtGIxwWujwxBvQhL9wgnUIwBkg-mndJJX07Igr6d0cic-g?e=4KJbWY, https://1drv.ms/t/c/12406a392c92914b/EciYj-O9Oi1PgNsZdTao0iwBub3gdfqA3safE0A4I9foYg?e=Mi39JB, and https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56083.md.

Details

CWE(s)
CWE-78

Affected Products

ruijie
rg-yst250f firmware
3.0\(1\)b11p280yst250f
ruijie
rg-est310 v2 firmware
b11p221
ruijie
reyee os
219, 221
ruijie
rg-eap602 firmware
3.0\(1\)b2p55

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

CVE enables remote exploitation of a public-facing web application (T1190, T1210) on a network device via crafted POST request, directly facilitating arbitrary Unix shell command execution (T1059.004) due to OS command injection in Lua script.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References