Ruijie RG-BCR600W CVE-2025-56082

Exploitation requires valid authenticated access to the RG-BCR600W web management interface (CVSS PR:L): the attacker must reach the LuCI-based admin controller and invoke the check_changes action in /usr/lib/lua/luci/controller/admin/common.lua via a crafted POST request whose parameters are passed into an OS command without sanitization. The key limiting factor is this authentication requirement - the attack is not viable against a device where the management interface is unreachable and credentials are strong. Practical risk rises sharply where the web UI is exposed to untrusted networks or where default/weak credentials are in use, which is common for SOHO/branch-class routers. No user interaction is required once authenticated (UI:N).

This is a genuine high-priority issue but not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8) describes a remotely reachable, low-complexity OS command injection that yields full compromise of the device, but it requires authentication (PR:L) rather than being fully unauthenticated - this is the single biggest limiting factor and tempers the raw score. Supporting signals are moderate: EPSS is 2.38% (84th percentile), which is elevated relative to the average CVE and consistent with a disclosed, technically documented flaw, but well short of values seen for mass-exploited bugs. The CVE is NOT on CISA KEV, so there is no evidence of active exploitation, and the input contains no explicit POC=YES flag, so no public exploit identified at time of analysis - though the referenced GitHub advisory and OneDrive attachments contain detailed technical write-ups that would substantially ease weaponization. No SSVC decision data was provided. Signals are broadly consistent (mid-high CVSS, moderate EPSS, no KEV), with the main nuance being that authentication is required, meaning realistic risk concentrates on devices with weak, default, or reused credentials, or where an attacker already has a foothold/low-privilege account.

An attacker with valid low-privilege web-interface credentials (or default/guessable credentials) to a Ruijie RG-BCR600W router sends a crafted POST request to the check_changes handler in common.lua, injecting shell metacharacters that the device executes as OS commands. This grants command execution on the router, enabling full device takeover and pivoting into the internal network. No public exploit is confirmed in the input, but a detailed technical advisory is publicly referenced.