CVE-2025-56093
Published: 11 December 2025
Summary
CVE-2025-56093 is a high-severity OS Command Injection (CWE-78) vulnerability in Ruijie X30 Pro Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 33.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires information input validation at entry points like the setWisp POST endpoint, directly preventing OS command injection from crafted requests.
Mandates identification, reporting, and correction of flaws such as the command injection in wireless.lua, enabling patching of this specific CVE.
Enforces least privilege to restrict low-privilege (PR:L) users from accessing the vulnerable setWisp function in the web interface.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables exploitation of public-facing web application via crafted POST request (T1190), resulting in arbitrary OS command injection on Linux-based device (T1059.004).
NVD Description
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the setWisp in file /usr/lib/lua/luci/modules/wireless.lua.
Deeper analysisAI
CVE-2025-56093 is an OS command injection vulnerability (CWE-78) affecting the Ruijie X30-PRO device, specifically version X30-PRO-V1_09241521. The flaw resides in the setWisp function within the file /usr/lib/lua/luci/modules/wireless.lua, where attackers can execute arbitrary operating system commands by sending a crafted POST request. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.
Exploitation requires low privileges, such as those held by an authenticated user with network access to the device. An attacker can remotely trigger the vulnerability with low complexity and no user interaction, achieving arbitrary command execution on the underlying operating system. This grants high-level control over the device, potentially enabling full compromise, data exfiltration, persistence, or further lateral movement within a network.
Advisories and detailed reports, including vulnerability analyses for this and related Ruijie device flaws, are available in the referenced GitHub repositories from flegoity and associated OneDrive documents. Practitioners should consult these sources for vendor-specific guidance on patches, workarounds, or configuration changes to mitigate exposure.
Details
- CWE(s)