CVE-2025-56083
Published: 11 December 2025
Summary
CVE-2025-56083 is a high-severity OS Command Injection (CWE-78) vulnerability in Ruijie Reyee Os. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by validating and sanitizing crafted POST request inputs to the module_set function in nbr_networkId_merge.lua.
Enforces restrictions on POST request parameters to block injection of shell metacharacters or malformed data targeting the vulnerable Lua endpoint.
Remediates the specific OS command injection flaw in Ruijie X30-PRO V1_09241521 firmware through timely flaw identification, patching, and testing.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables remote exploitation of a public-facing web application (T1190, T1210) on a network device via crafted POST request, directly facilitating arbitrary Unix shell command execution (T1059.004) due to OS command injection in Lua script.
NVD Description
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_networkId_merge.lua.
Deeper analysisAI
CVE-2025-56083 is an OS Command Injection vulnerability (CWE-78) in the Ruijie X30-PRO device, specifically version X30-PRO-V1_09241521. The issue affects the module_set function in the file /usr/local/lua/dev_sta/nbr_networkId_merge.lua, enabling attackers to execute arbitrary operating system commands via a crafted POST request. Published on 2025-12-11T18:16:20.420, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
The vulnerability can be exploited remotely by attackers with low privileges (PR:L), requiring low attack complexity and no user interaction. Exploitation occurs over the network through a specially crafted POST request to the vulnerable endpoint, granting attackers high-level access to execute arbitrary OS commands and compromise confidentiality, integrity, and availability.
Advisories and detailed reports on this vulnerability, including potential exploitation details, are available at the following references: https://1drv.ms/f/c/12406a392c92914b/EtGIxwWujwxBvQhL9wgnUIwBkg-mndJJX07Igr6d0cic-g?e=4KJbWY, https://1drv.ms/t/c/12406a392c92914b/EciYj-O9Oi1PgNsZdTao0iwBub3gdfqA3safE0A4I9foYg?e=Mi39JB, and https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56083.md.
Details
- CWE(s)