CVE-2025-56096
Published: 11 December 2025
Summary
CVE-2025-56096 is a high-severity OS Command Injection (CWE-78) vulnerability in Ruijie Rg-Bcr600W Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of crafted POST request inputs to the restart_modules function, directly preventing OS command injection exploitation.
Mandates timely identification, reporting, and remediation of the flaw in /usr/lib/lua/luci/controller/admin/common.lua, patching the vulnerability per advisories.
Enforces least privilege to restrict access to the vulnerable restart_modules endpoint beyond low-privilege authenticated users.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The OS Command Injection vulnerability in the web admin interface (LuCI controller) enables exploitation of a public-facing application (T1190) via crafted POST requests, facilitating arbitrary Unix shell command execution (T1059.004) on the device.
NVD Description
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the restart_modules in file /usr/lib/lua/luci/controller/admin/common.lua.
Deeper analysisAI
CVE-2025-56096 is an OS Command Injection vulnerability (CWE-78) affecting Ruijie RG-BCR and RG-BCR600W devices. Published on 2025-12-11, the flaw exists in the restart_modules function within the file /usr/lib/lua/luci/controller/admin/common.lua, where attackers can execute arbitrary operating system commands by sending a crafted POST request.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility, low attack complexity, and the need for low privileges such as an authenticated user account. Exploitation requires no user interaction and has no impact on scope, but successful attacks enable high-impact compromise of confidentiality, integrity, and availability, including arbitrary command execution on the device.
Advisories providing further details on mitigation and patches are available at the following references: https://1drv.ms/f/c/12406a392c92914b/Evvem8Mw6SlNh-ZJpY_9SAsBq2iDi88TFdFdA1Am3PdfCQ?e=YeLYxb, https://1drv.ms/t/c/12406a392c92914b/EQ8FKwFLNjBLlL9hyg_YkUoBdsj_FcNtQsjdmKQ5M4-10A?e=bFC7Jg, and https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56096.md.
Details
- CWE(s)