CVE-2025-56113

CVE-2025-56113 is an OS Command Injection vulnerability (CWE-78) affecting Ruijie RG-YST EST software, specifically the YSTAP_3.0(1)B11P280YST250F V1.xxV2.xx version. The flaw resides in the pwdmodify function within the file /usr/lib/lua/luci/modules/common.lua, where attackers can inject and execute arbitrary operating system commands through a specially crafted POST request. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.

Exploitation requires low privileges (PR:L), making it accessible to authenticated users such as low-level administrators or service accounts. Attackers can remotely trigger the vulnerability over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), leading to arbitrary command execution on the underlying operating system. Successful exploitation grants high-level control over the affected device, potentially enabling full system compromise, data exfiltration, persistence, or lateral movement within the network.

Mitigation guidance and patch details are outlined in security advisories and reports available via the CVE references, including a dedicated GitHub vulnerability report at https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56113.md and supporting documents on OneDrive. Practitioners should consult these sources for vendor-recommended updates, configuration hardening, or workarounds to address the issue.