CVE-2025-56127
Published: 11 December 2025
Description
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the get_wanobj in file /usr/lib/lua/luci/controller/admin/common.lua.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring identification, reporting, and timely correction of the OS command injection flaw in the get_wanobj function.
Prevents exploitation by validating and sanitizing crafted POST request inputs to the vulnerable Lua controller before processing.
Restricts malicious input payloads in POST requests to the get_wanobj function, rejecting or delaying invalid commands.
Security SummaryAI
CVE-2025-56127 is an OS Command Injection vulnerability (CWE-78) affecting the Ruijie RG-BCR RG-BCR600W device. The flaw resides in the get_wanobj function within the file /usr/lib/lua/luci/controller/admin/common.lua, where attackers can inject and execute arbitrary operating system commands through a specially crafted POST request. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.
Attackers with low privileges, such as authenticated users with network access to the device, can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation allows execution of arbitrary commands on the underlying operating system, potentially leading to full device compromise, including data exfiltration, modification of configurations, or further lateral movement within the network.
Mitigation details, including patches and remediation steps, are outlined in vendor advisories and independent reports available at the following references: https://1drv.ms/f/c/12406a392c92914b/Evvem8Mw6SlNh-ZJpY_9SAsBq2iDi88TFdFdA1Am3PdfCQ?e=YeLYxb, https://1drv.ms/t/c/12406a392c92914b/EQkKqI8NW45AgBgScwGNiPABEK0YLvNQFgNtqLaWAhCPVw?e=cLDW5t, and https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56127.md. Security practitioners should review these for device-specific updates and apply them promptly.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS Command Injection via crafted POST request to web interface enables exploitation of public-facing application (T1190) and arbitrary Unix shell command execution (T1059).