CVE-2025-56117
Published: 11 December 2025
Description
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.
Mitigating Controls (NIST 800-53 r5)AI
Validates information inputs from crafted POST requests to the module_set function in nbr_cwmp.lua, directly preventing OS command injection (CWE-78).
Identifies, reports, and corrects the specific flaw in /usr/local/lua/dev_sta/nbr_cwmp.lua through timely flaw remediation and patching.
Enforces least privilege on low-privilege accounts (PR:L) required for exploitation, limiting the impact of injected OS commands on confidentiality, integrity, and availability.
Security SummaryAI
CVE-2025-56117 is an OS Command Injection vulnerability (CWE-78) in the Ruijie X30-PRO device, specifically version X30-PRO-V1_09241521. The issue affects the module_set function in the file /usr/local/lua/dev_sta/nbr_cwmp.lua, where a crafted POST request enables attackers to execute arbitrary operating system commands. Published on 2025-12-11T19:15:57.153, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and significant impact potential.
Attackers with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). By sending a specially crafted POST request to the vulnerable module_set endpoint, they can inject and execute arbitrary OS commands, resulting in high confidentiality, integrity, and availability impacts (C:H/I:H/A:H) within the unchanged security scope (S:U).
Advisories and technical reports for mitigation are available in the CVE references, including documents hosted on OneDrive at https://1drv.ms/f/c/12406a392c92914b/EtGIxwWujwxBvQhL9wgnUIwBkg-mndJJX07Igr6d0cic-g?e=4KJbWY and https://1drv.ms/t/c/12406a392c92914b/Ed2lBCN9vhdPnEs7WKvpfEQBp7czazgO9PYxS2TFSHx7TQ?e=HZZaGq, as well as a detailed report on GitHub at https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56117.md.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an OS command injection via crafted POST request to a web interface on a network device (AV:N/PR:L), enabling exploitation of public-facing application (T1190) and arbitrary Unix shell command execution (T1059.004).