Cyber Posture

CVE-2025-56096

High

Published: 11 December 2025

Published
11 December 2025
Modified
26 December 2025
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0019 40.7th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the restart_modules in file /usr/lib/lua/luci/controller/admin/common.lua.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Requires validation of crafted POST request inputs to the restart_modules function, directly preventing OS command injection exploitation.

SI-2 Flaw Remediation good match
prevent

Mandates timely identification, reporting, and remediation of the flaw in /usr/lib/lua/luci/controller/admin/common.lua, patching the vulnerability per advisories.

AC-6 Least Privilege partial match
prevent

Enforces least privilege to restrict access to the vulnerable restart_modules endpoint beyond low-privilege authenticated users.

Security SummaryAI

CVE-2025-56096 is an OS Command Injection vulnerability (CWE-78) affecting Ruijie RG-BCR and RG-BCR600W devices. Published on 2025-12-11, the flaw exists in the restart_modules function within the file /usr/lib/lua/luci/controller/admin/common.lua, where attackers can execute arbitrary operating system commands by sending a crafted POST request.

The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility, low attack complexity, and the need for low privileges such as an authenticated user account. Exploitation requires no user interaction and has no impact on scope, but successful attacks enable high-impact compromise of confidentiality, integrity, and availability, including arbitrary command execution on the device.

Advisories providing further details on mitigation and patches are available at the following references: https://1drv.ms/f/c/12406a392c92914b/Evvem8Mw6SlNh-ZJpY_9SAsBq2iDi88TFdFdA1Am3PdfCQ?e=YeLYxb, https://1drv.ms/t/c/12406a392c92914b/EQ8FKwFLNjBLlL9hyg_YkUoBdsj_FcNtQsjdmKQ5M4-10A?e=bFC7Jg, and https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56096.md.

Details

CWE(s)
CWE-78

Affected Products

ruijie
rg-bcr600w firmware
all versions

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

The OS Command Injection vulnerability in the web admin interface (LuCI controller) enables exploitation of a public-facing application (T1190) via crafted POST requests, facilitating arbitrary Unix shell command execution (T1059.004) on the device.

References