Cyber Posture

CVE-2025-56102

HighPublic PoC

Published: 11 December 2025

Published
11 December 2025
Modified
27 January 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0105 77.6th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents OS command injection by requiring validation of crafted POST request inputs to the module_get function in networkConnect.lua.

SI-2 Flaw Remediation good match
prevent

Mandates timely remediation of the specific flaw in Ruijie RG-EW1800GX firmware version B11P226_EW1800GX_10223121 through patching.

AC-6 Least Privilege partial match
prevent

Limits impact of arbitrary command execution by enforcing least privilege on low-privilege (PR:L) accounts exploiting the vulnerability.

Security SummaryAI

CVE-2025-56102, published on 2025-12-11, is an OS Command Injection vulnerability (CWE-78) in the Ruijie RG-EW1800GX firmware version B11P226_EW1800GX_10223121. The issue affects the module_get function in the file /usr/local/lua/dev_sta/networkConnect.lua, where attackers can execute arbitrary commands by sending a crafted POST request. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.

The vulnerability can be exploited by attackers who have low privileges (PR:L) on the affected device, requiring no user interaction and allowing remote exploitation over the network. Successful attacks enable arbitrary OS command execution, potentially granting full control over the device.

Mitigation details and additional technical information are provided in the following advisories and reports: https://1drv.ms/f/c/12406a392c92914b/EgUg1zJuaItDmLxZhkCg4B8BcJTRYnXyX4ePIIjNoZrRew?e=a23cK6, https://1drv.ms/t/c/12406a392c92914b/EXNcf0lLKjZLv6U4-ErArMkBKqwLJhJbiJwuQl5MSd0W3w?e=GfXnnz, and https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56102.md.

Details

CWE(s)
CWE-78

Affected Products

ruijie
rg-ew1800gx firmware
3.0\(1\)b11p226
ruijie
rg-ew300r firmware
3.0\(1\)b11p301

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

The OS command injection vulnerability in the web management interface (crafted POST request) directly enables exploitation of a public-facing application (T1190), privilege escalation from low privileges to arbitrary command execution (T1068), and execution of Unix shell commands on the Linux-based firmware (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References