Ruijie RG-RAP2200(E) CVE-2025-56077

Exploitation requires network access to the device's management/web interface and low-privilege authenticated access (CVSS PR:L), after which a crafted POST request targeting the module_set functionality in /usr/local/lua/dev_sta/nbr_cwmp.lua injects arbitrary OS commands via unsanitized input. The primary limiting factor is the need for valid (low-level) credentials and reachability of the management interface - devices that do not expose management to untrusted networks and that use strong credentials significantly reduce exposure. Affected scope is bounded to specific firmware: Ruijie RG-RAP2200(E) firmware 3.0(1)B11P247 and Reyee OS 2.280.0 per the CPE data.

This is a genuine, actionable priority rather than an inflated high-CVSS issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity OS command injection requiring only low-privilege authentication (PR:L) and no user interaction, yielding full confidentiality, integrity, and availability impact - classic full-device-takeover characteristics for an embedded router/AP. Publicly available exploit code exists (POC referenced via GitHub and OneDrive links), which materially increases real-world risk by lowering the skill barrier. The EPSS score of 2.84% sits at the 86th percentile - elevated relative to the average CVE but not indicative of mass automated exploitation, consistent with a device-specific flaw affecting a particular vendor appliance rather than ubiquitous software. The CVE is NOT listed in CISA KEV, so there is no confirmation of active in-the-wild exploitation. Net: the combination of network vector, low complexity, full impact, and a public POC warrants prompt patching, but the authentication requirement (PR:L) and the niche product footprint temper the likelihood of indiscriminate, large-scale exploitation. No conflicting signals were observed between the CVSS vector and the description; both agree on network-based, authenticated command injection.

An attacker with low-privilege access to the device's management interface (or who has obtained weak/default credentials on an exposed RG-RAP2200(E)) sends a crafted POST request to the module_set handler in /usr/local/lua/dev_sta/nbr_cwmp.lua, injecting shell metacharacters that are passed unsanitized to an OS command. This grants arbitrary command execution on the access point. Public exploit code for this specific CVE is available, reducing the effort needed to reproduce the attack.