Cyber Posture

CVE-2025-56102

HighPublic PoCRCE

Published: 11 December 2025

Published
11 December 2025
Modified
27 January 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0060 69.6th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-56102 is a high-severity OS Command Injection (CWE-78) vulnerability in Ruijie Rg-Ew1800Gx Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 30.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents OS command injection by requiring validation of crafted POST request inputs to the module_get function in networkConnect.lua.

prevent

Mandates timely remediation of the specific flaw in Ruijie RG-EW1800GX firmware version B11P226_EW1800GX_10223121 through patching.

prevent

Limits impact of arbitrary command execution by enforcing least privilege on low-privilege (PR:L) accounts exploiting the vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

The OS command injection vulnerability in the web management interface (crafted POST request) directly enables exploitation of a public-facing application (T1190), privilege escalation from low privileges to arbitrary command execution (T1068), and execution of Unix shell commands on the Linux-based firmware (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.

Deeper analysisAI

CVE-2025-56102, published on 2025-12-11, is an OS Command Injection vulnerability (CWE-78) in the Ruijie RG-EW1800GX firmware version B11P226_EW1800GX_10223121. The issue affects the module_get function in the file /usr/local/lua/dev_sta/networkConnect.lua, where attackers can execute arbitrary commands by sending a crafted POST request. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.

The vulnerability can be exploited by attackers who have low privileges (PR:L) on the affected device, requiring no user interaction and allowing remote exploitation over the network. Successful attacks enable arbitrary OS command execution, potentially granting full control over the device.

Mitigation details and additional technical information are provided in the following advisories and reports: https://1drv.ms/f/c/12406a392c92914b/EgUg1zJuaItDmLxZhkCg4B8BcJTRYnXyX4ePIIjNoZrRew?e=a23cK6, https://1drv.ms/t/c/12406a392c92914b/EXNcf0lLKjZLv6U4-ErArMkBKqwLJhJbiJwuQl5MSd0W3w?e=GfXnnz, and https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56102.md.

Details

CWE(s)

Affected Products

ruijie
rg-ew1800gx firmware
3.0\(1\)b11p226
ruijie
rg-ew300r firmware
3.0\(1\)b11p301

CVEs Like This One

CVE-2025-56091Same product: Ruijie Rg-Ew1800Gx
CVE-2025-56106Same product: Ruijie Rg-Ew1800Gx
CVE-2025-56098Same vendor: Ruijie
CVE-2025-56094Same vendor: Ruijie
CVE-2025-56107Same vendor: Ruijie
CVE-2025-56082Same vendor: Ruijie
CVE-2025-56122Same product: Ruijie Rg-Ew1800Gx
CVE-2025-56086Same vendor: Ruijie
CVE-2025-56095Same vendor: Ruijie
CVE-2025-56117Same vendor: Ruijie

References