Cyber Posture

CVE-2025-56111

HighPublic PoC

Published: 11 December 2025

Published
11 December 2025
Modified
07 January 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0165 82.1th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the network_set_wan_conf in file /usr/lib/lua/luci/controller/admin/netport.lua.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly mitigates OS command injection by requiring validation and sanitization of crafted POST request inputs to the network_set_wan_conf function, preventing arbitrary command execution.

SI-2 Flaw Remediation good match
preventrecover

Addresses the specific flaw in /usr/lib/lua/luci/controller/admin/netport.lua through timely identification, reporting, and remediation via patches or code fixes.

AC-6 Least Privilege partial match
prevent

Limits damage from low-privilege (PR:L) authenticated attackers by enforcing least privilege on access to the vulnerable administrative network configuration function.

Security SummaryAI

CVE-2025-56111 is an OS command injection vulnerability (CWE-78) affecting Ruijie RG-BCR RG-BCR860 network devices. The flaw resides in the network_set_wan_conf function within the file /usr/lib/lua/luci/controller/admin/netport.lua, where attackers can execute arbitrary operating system commands by sending a crafted POST request. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

An attacker with low privileges, such as an authenticated user (PR:L), can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows arbitrary command execution on the underlying OS, potentially leading to full device compromise, including high impacts on confidentiality, integrity, and availability.

Detailed advisories and reports on mitigation are available in the referenced sources, including https://1drv.ms/f/c/12406a392c92914b/EqEQemupso9DldgG-EcUI8IBLpEWP_S-f6vpeUtYztYYCg?e=gX4A10, https://1drv.ms/t/c/12406a392c92914b/ERJa0DnnR29MqtbLLRQirGYB4qA9dAdpn6eIJH9LwNlBmw?e=y6KkGo, and https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56111.md.

Details

CWE(s)
CWE-78

Affected Products

ruijie
rg-bcr860 firmware
2.5.13-r2224

MITRE ATT&CK Enterprise TechniquesAI

T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

OS command injection via web interface on network device enables arbitrary command execution (T1059.008 Network Device CLI) and exploitation of public-facing application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References