Ruijie RG-EW1300G CVE-2025-56079

Requires authenticated access to the RG-EW1300G web management interface with at least low-privileged credentials (CVSS PR:L), used to send a crafted POST request to the module_get function in /usr/local/lua/dev_sta/networkConnect.lua, where a parameter is passed to an OS command without sanitization. Exploitation is limited by the need for valid credentials and network reachability of the management interface; it does NOT require user interaction (UI:N) or high privileges, and no non-default configuration is indicated. Affected firmware is EW1300G V1.00, V2.00, and V4.00. Real-world risk is reduced where the admin interface is not exposed to untrusted networks and strong unique credentials are enforced.

This is a credible operational priority but short of an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack that nonetheless requires some level of authentication (PR:L), yielding full confidentiality, integrity and availability loss via command injection (CWE-78). A public proof-of-concept exists (GitHub write-up plus two hosted exploit artifacts), which materially raises exploitability. However, the EPSS score of 2.84% (86th percentile) indicates only moderate near-term exploitation probability - elevated relative to the average CVE but far from the >30% range typical of mass-exploited flaws - and the vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. The PR:L requirement is the key risk limiter: an attacker needs valid (even low-privileged) web-interface credentials, which tempers the 'network unauthenticated' worst case. No SSVC decision data was supplied in the input, so automatable/exploitation-status cannot be independently derived beyond the signals above. Net: a real, POC-backed vulnerability on an edge device (high impact if exploited), but gated by authentication and with no evidence of in-the-wild use - prioritize patching for exposed/shared-credential deployments rather than treating it as a zero-day.

An attacker with low-privileged credentials to the Ruijie RG-EW1300G web management interface - obtained via default/weak passwords, credential reuse, or a shared network - sends a crafted POST request to the module_get handler in networkConnect.lua, embedding shell metacharacters in a parameter that is passed unsanitized to an OS command. Because publicly available exploit code exists, the barrier to reproduction is low, and successful injection grants arbitrary command execution on the router (typically as root), enabling full device takeover and pivoting into the internal network.