CVE-2025-56108
Published: 11 December 2025
Summary
CVE-2025-56108 is a high-severity OS Command Injection (CWE-78) vulnerability in Ruijie X30 Pro Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 47.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires input validation mechanisms at the pwdmodify endpoint to reject crafted POST requests containing OS command injection payloads.
Mandates timely remediation of the command injection flaw in /usr/lib/lua/luci/modules/common.lua through patching or updates.
Enforces restrictions on POST request inputs to the pwdmodify function, such as character sets and lengths, to block injection attempts.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection directly enables arbitrary Unix shell command execution (T1059.004) on the network device and facilitates privilege escalation from low-privileged access (PR:L) to full system compromise (T1068).
NVD Description
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua.
Deeper analysisAI
CVE-2025-56108 is an OS command injection vulnerability (CWE-78) affecting the Ruijie X30-PRO device, specifically version X30-PRO-V1_09241521. The flaw resides in the pwdmodify function within the file /usr/lib/lua/luci/modules/common.lua, where attackers can execute arbitrary operating system commands by sending a crafted POST request. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low attack complexity, and potential for high impact on confidentiality, integrity, and availability.
An attacker with low privileges (PR:L), such as an authenticated user on the device, can exploit this vulnerability remotely over the network without user interaction. By crafting a malicious POST request to the pwdmodify endpoint, the attacker injects and executes arbitrary OS commands, potentially leading to full system compromise, including data exfiltration, persistence, or further lateral movement within the network.
Advisories and detailed reports on this vulnerability, including potential patches or workarounds, are available in the following references: https://1drv.ms/f/c/12406a392c92914b/EtGIxwWujwxBvQhL9wgnUIwBkg-mndJJX07Igr6d0cic-g?e=4KJbWY, https://1drv.ms/t/c/12406a392c92914b/Ecib6--fxv9HhrfAdhmP5R4BOPDcTcqTOBt0hQBEx5BTxA?e=s3ejN1, and https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56108.md. Security practitioners should consult these for mitigation guidance specific to affected Ruijie deployments.
Details
- CWE(s)