CVE-2025-56099
Published: 11 December 2025
Description
OS Command Injection vulnerability in Ruijie RG-YST AP_3.0(1)B11P280YST250F allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua.
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of all information inputs, directly preventing OS command injection by ensuring crafted POST requests to pwdmodify do not contain executable commands.
Mandates timely identification, reporting, and correction of flaws like the command injection vulnerability in /usr/lib/lua/luci/modules/common.lua.
Restricts information inputs to system-defined acceptable content types and sources, blocking malicious payloads in POST requests targeting pwdmodify.
Security SummaryAI
CVE-2025-56099 is an OS Command Injection vulnerability (CWE-78) in Ruijie RG-YST AP_3.0(1)B11P280YST250F. The issue affects the pwdmodify function in the file /usr/lib/lua/luci/modules/common.lua, where a crafted POST request enables attackers to execute arbitrary operating system commands. The vulnerability was published on 2025-12-11T19:15:55.860 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N). By sending a specially crafted POST request to the pwdmodify endpoint, the attacker achieves arbitrary command execution on the underlying OS, resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H) within the affected system's scope (S:U).
Advisories and additional details on mitigation are provided in the following references: https://1drv.ms/f/c/12406a392c92914b/EjgEtJ5yojhDpEoT-PbidhsBzsbVnT-D-32qK1bCrQN3-g?e=cVRYgN, https://1drv.ms/t/c/12406a392c92914b/ETaD7apCrPFLtMj473NHV2gBaYrKV9A4ZZKMfyWgC949Zw?e=iyjx5g, and https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56099.md.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of a public-facing web application (T1190) via crafted POST request for OS command injection, directly facilitating Unix Shell command execution (T1059.004) on the Linux-based device.