CVE-2025-56127
Published: 11 December 2025
Summary
CVE-2025-56127 is a high-severity OS Command Injection (CWE-78) vulnerability in Ruijie Rg-Bcr600W Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 17.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-56127 is an OS Command Injection vulnerability (CWE-78) affecting the Ruijie RG-BCR RG-BCR600W device. The flaw resides in the get_wanobj function within the file /usr/lib/lua/luci/controller/admin/common.lua, where attackers can inject and execute arbitrary operating system commands through a specially crafted POST request. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.
Attackers with low privileges, such as authenticated users with network access to the device, can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation allows execution of arbitrary commands on the underlying operating system, potentially leading to full device compromise, including data exfiltration, modification of configurations, or further lateral movement within the network.
Mitigation details, including patches and remediation steps, are outlined in vendor advisories and independent reports available at the following references: https://1drv.ms/f/c/12406a392c92914b/Evvem8Mw6SlNh-ZJpY_9SAsBq2iDi88TFdFdA1Am3PdfCQ?e=YeLYxb, https://1drv.ms/t/c/12406a392c92914b/EQkKqI8NW45AgBgScwGNiPABEK0YLvNQFgNtqLaWAhCPVw?e=cLDW5t, and https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56127.md. Security practitioners should review these for device-specific updates and apply them promptly.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-202889
Vulnerability details
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request to the get_wanobj in file /usr/lib/lua/luci/controller/admin/common.lua.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS Command Injection via crafted POST request to web interface enables exploitation of public-facing application (T1190) and arbitrary Unix shell command execution (T1059).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring identification, reporting, and timely correction of the OS command injection flaw in the get_wanobj function.
Prevents exploitation by validating and sanitizing crafted POST request inputs to the vulnerable Lua controller before processing.
Restricts malicious input payloads in POST requests to the get_wanobj function, rejecting or delaying invalid commands.