CVE-2025-56102
Published: 11 December 2025
Summary
CVE-2025-56102 is a high-severity OS Command Injection (CWE-78) vulnerability in Ruijie Rg-Ew1800Gx Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 28.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-56102, published on 2025-12-11, is an OS Command Injection vulnerability (CWE-78) in the Ruijie RG-EW1800GX firmware version B11P226_EW1800GX_10223121. The issue affects the module_get function in the file /usr/local/lua/dev_sta/networkConnect.lua, where attackers can execute arbitrary commands by sending a crafted POST request. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.
The vulnerability can be exploited by attackers who have low privileges (PR:L) on the affected device, requiring no user interaction and allowing remote exploitation over the network. Successful attacks enable arbitrary OS command execution, potentially granting full control over the device.
Mitigation details and additional technical information are provided in the following advisories and reports: https://1drv.ms/f/c/12406a392c92914b/EgUg1zJuaItDmLxZhkCg4B8BcJTRYnXyX4ePIIjNoZrRew?e=a23cK6, https://1drv.ms/t/c/12406a392c92914b/EXNcf0lLKjZLv6U4-ErArMkBKqwLJhJbiJwuQl5MSd0W3w?e=GfXnnz, and https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56102.md.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-202730
Vulnerability details
OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The OS command injection vulnerability in the web management interface (crafted POST request) directly enables exploitation of a public-facing application (T1190), privilege escalation from low privileges to arbitrary command execution (T1068), and execution of Unix shell commands on the Linux-based firmware (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents OS command injection by requiring validation of crafted POST request inputs to the module_get function in networkConnect.lua.
Mandates timely remediation of the specific flaw in Ruijie RG-EW1800GX firmware version B11P226_EW1800GX_10223121 through patching.
Limits impact of arbitrary command execution by enforcing least privilege on low-privilege (PR:L) accounts exploiting the vulnerability.