CVE-2025-56117
Published: 11 December 2025
Summary
CVE-2025-56117 is a high-severity OS Command Injection (CWE-78) vulnerability in Ruijie X30 Pro Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates information inputs from crafted POST requests to the module_set function in nbr_cwmp.lua, directly preventing OS command injection (CWE-78).
Identifies, reports, and corrects the specific flaw in /usr/local/lua/dev_sta/nbr_cwmp.lua through timely flaw remediation and patching.
Enforces least privilege on low-privilege accounts (PR:L) required for exploitation, limiting the impact of injected OS commands on confidentiality, integrity, and availability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an OS command injection via crafted POST request to a web interface on a network device (AV:N/PR:L), enabling exploitation of public-facing application (T1190) and arbitrary Unix shell command execution (T1059.004).
NVD Description
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.
Deeper analysisAI
CVE-2025-56117 is an OS Command Injection vulnerability (CWE-78) in the Ruijie X30-PRO device, specifically version X30-PRO-V1_09241521. The issue affects the module_set function in the file /usr/local/lua/dev_sta/nbr_cwmp.lua, where a crafted POST request enables attackers to execute arbitrary operating system commands. Published on 2025-12-11T19:15:57.153, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and significant impact potential.
Attackers with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). By sending a specially crafted POST request to the vulnerable module_set endpoint, they can inject and execute arbitrary OS commands, resulting in high confidentiality, integrity, and availability impacts (C:H/I:H/A:H) within the unchanged security scope (S:U).
Advisories and technical reports for mitigation are available in the CVE references, including documents hosted on OneDrive at https://1drv.ms/f/c/12406a392c92914b/EtGIxwWujwxBvQhL9wgnUIwBkg-mndJJX07Igr6d0cic-g?e=4KJbWY and https://1drv.ms/t/c/12406a392c92914b/Ed2lBCN9vhdPnEs7WKvpfEQBp7czazgO9PYxS2TFSHx7TQ?e=HZZaGq, as well as a detailed report on GitHub at https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56117.md.
Details
- CWE(s)