Cyber Posture

CVE-2025-56107

High

Published: 11 December 2025

Published
11 December 2025
Modified
26 December 2025
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0012 30.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the submit_wifi in file /usr/lib/lua/luci/controller/admin/common_quick_config.lua.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly mitigates OS command injection by requiring validation of POST request inputs to the submit_wifi function in the Lua controller.

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and correction of the specific command injection flaw in /usr/lib/lua/luci/controller/admin/common_quick_config.lua.

AC-6 Least Privilege partial match
prevent

Limits the scope and impact of arbitrary command execution by restricting privileges of the vulnerable web process to least necessary.

Security SummaryAI

CVE-2025-56107 is an OS Command Injection vulnerability (CWE-78) in the Ruijie RG-BCR RG-BCR600W device. The issue affects the submit_wifi function in the file /usr/lib/lua/luci/controller/admin/common_quick_config.lua, where a crafted POST request enables attackers to execute arbitrary operating system commands. Published on 2025-12-11, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.

Attackers with low privileges, such as authenticated users, can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By sending a specially crafted POST request to the vulnerable endpoint, they can inject and execute arbitrary OS commands on the affected device, potentially achieving full administrative control, data exfiltration, or further network compromise.

Advisories and detailed reports on this vulnerability, including potential mitigations, are available in the following references: https://1drv.ms/f/c/12406a392c92914b/Evvem8Mw6SlNh-ZJpY_9SAsBq2iDi88TFdFdA1Am3PdfCQ?e=YeLYxb, https://1drv.ms/t/c/12406a392c92914b/ESr3_xpg5ZxFkRAKG7hiGVcBF3Cw_52dWpSvUOtgx3hPhw?e=c5RTxg, and https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56107.md.

Details

CWE(s)
CWE-78

Affected Products

ruijie
rg-bcr600w firmware
all versions

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

OS command injection via web interface (T1190: Exploit Public-Facing Application), enables arbitrary Unix shell command execution (T1059.004), and facilitates privilege escalation from low-priv to admin (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References