CVE-2025-56090

CVE-2025-56090 is an OS Command Injection vulnerability (CWE-78) in the Ruijie RG-EW1200G PRO router across firmware versions V1.00, V2.00, V3.00, and V4.00. The issue affects the module_set function in the file /usr/local/lua/dev_config/config_retain.lua, where attackers can execute arbitrary operating system commands by sending a crafted POST request. Published on 2025-12-11, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

The vulnerability can be exploited remotely over the network by attackers with low privileges, such as authenticated users, requiring low attack complexity and no user interaction. Successful exploitation allows arbitrary command execution on the underlying operating system, resulting in high impacts to confidentiality, integrity, and availability, potentially leading to full device compromise, data theft, or further network pivoting.

Mitigation details and additional technical reports are documented in the following references: https://1drv.ms/f/c/12406a392c92914b/EkH0xWseMXBJg-Ck_uD34fcB-3pDo3MAQc2AKNlXqwYr2w?e=GU9l62, https://1drv.ms/t/c/12406a392c92914b/EfSHWqE3N11FpgQsV1BlZk0BxXIhFQjIp_xmJYIq1APvrw?e=JCIm6k, and https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56090.md. Security practitioners should consult these for patch availability, workarounds, or proof-of-concept details.