CVE-2025-56099
Published: 11 December 2025
Summary
CVE-2025-56099 is a high-severity OS Command Injection (CWE-78) vulnerability in Ruijie Reyee Os. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of all information inputs, directly preventing OS command injection by ensuring crafted POST requests to pwdmodify do not contain executable commands.
Mandates timely identification, reporting, and correction of flaws like the command injection vulnerability in /usr/lib/lua/luci/modules/common.lua.
Restricts information inputs to system-defined acceptable content types and sources, blocking malicious payloads in POST requests targeting pwdmodify.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of a public-facing web application (T1190) via crafted POST request for OS command injection, directly facilitating Unix Shell command execution (T1059.004) on the Linux-based device.
NVD Description
OS Command Injection vulnerability in Ruijie RG-YST AP_3.0(1)B11P280YST250F allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua.
Deeper analysisAI
CVE-2025-56099 is an OS Command Injection vulnerability (CWE-78) in Ruijie RG-YST AP_3.0(1)B11P280YST250F. The issue affects the pwdmodify function in the file /usr/lib/lua/luci/modules/common.lua, where a crafted POST request enables attackers to execute arbitrary operating system commands. The vulnerability was published on 2025-12-11T19:15:55.860 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N). By sending a specially crafted POST request to the pwdmodify endpoint, the attacker achieves arbitrary command execution on the underlying OS, resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H) within the affected system's scope (S:U).
Advisories and additional details on mitigation are provided in the following references: https://1drv.ms/f/c/12406a392c92914b/EjgEtJ5yojhDpEoT-PbidhsBzsbVnT-D-32qK1bCrQN3-g?e=cVRYgN, https://1drv.ms/t/c/12406a392c92914b/ETaD7apCrPFLtMj473NHV2gBaYrKV9A4ZZKMfyWgC949Zw?e=iyjx5g, and https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56099.md.
Details
- CWE(s)