Ruijie X30-PRO CVE-2025-56083
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to device management interface
-
DeliverySend crafted POST to module_set in nbr_networkId_merge.lua
-
ExploitInject shell metacharacters into OS command
-
ExecutionExecute arbitrary commands on device
-
ImpactFull device takeover and pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privilege session to the Ruijie device's web/management interface (CVSS PR:L); the attacker then sends a crafted POST request targeting the module_set parameter processed by /usr/local/lua/dev_sta/nbr_networkId_merge.lua, injecting shell metacharacters into an OS command. Limiting factors: valid credentials or an existing authenticated session are needed, so unauthenticated internet-wide exploitation is not indicated; exposure is further reduced where the management interface is not reachable from untrusted networks. No user interaction is required (UI:N). |
| Impact | This is a genuinely serious but not top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity OS command injection requiring only low-level privileges (PR:L), yielding full confidentiality, integrity and availability impact - effectively device takeover. However, the exploitation signals temper the raw score: EPSS is only 2.00% (80th percentile), which is elevated-but-not-high and indicates modest predicted exploitation likelihood; there is no CISA KEV listing, so there is no public confirmation of active exploitation. No SSVC decision data was supplied. The authentication requirement (PR:L) is the key mitigating factor - an attacker needs a valid low-privilege session, so this is not a drive-by unauthenticated compromise. A third-party vulnerability report exists on GitHub (flegoity repo) and the description includes a precise injection point, so technical exploitation details are effectively public even though no formal POC/KEV flag was set in the input. Note a data inconsistency: the description names the Ruijie X30-PRO (firmware X30-PRO-V1_09241521), but the CPE list contains entirely different products (rg-yst250f, rg-est310_v2, rg-eap602, reyee_os) - verify the actual affected inventory with the vendor before scoping. |
| Exploit ScenarioDerived | An attacker with a low-privilege authenticated session to the Ruijie device's management interface sends a crafted POST request to the module_set handler in /usr/local/lua/dev_sta/nbr_networkId_merge.lua, injecting shell metacharacters that the Lua code passes to an OS command. This executes arbitrary commands on the device, leading to full compromise. A public vulnerability report with technical detail on the injection point is available on GitHub, lowering the barrier to weaponization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
OS command injection in Ruijie X30-PRO (firmware X30-PRO-V1_09241521) and related Reyee OS-based Ruijie devices allows an authenticated low-privilege user to execute arbitrary operating-system commands on the device by sending a crafted POST request to the module_set parameter processed by /usr/local/lua/dev_sta/nbr_networkId_merge.lua. The issue carries a CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and EPSS of 2.00% (80th percentile), indicating a real but currently modest level of exploitation interest; no CISA KEV listing is present and no public exploit code was identified at time of analysis, so this is a serious but not top-tier emergency. The practical barrier is the required authenticated session on the web/management interface, which means unauthenticated internet-wide exploitation is not indicated.
RemediationAI
No vendor-released patch was identified at time of analysis, so priority should go to reducing exposure of the management interface. First, ensure the device web/management UI is never reachable from the internet or untrusted VLANs - bind it to a dedicated management subnet, place it behind a firewall/ACL that permits only trusted administrative hosts, and prefer VPN-based access; the trade-off is that remote administration becomes less convenient and must be routed through the VPN. Second, change default and shared credentials and apply least privilege to any accounts that can reach the interface: because exploitation requires only PR:L, any valid low-privilege login is sufficient, so eliminating default and unnecessary accounts directly shrinks the attack surface. Third, disable any remote-management or cloud/relay features (for example Reyee cloud or external management exposure) that extend the interface beyond the local network, accepting reduced centralized management as the cost. Fourth, monitor device and upstream logs for suspicious POST requests to module_set or the nbr_networkId_merge.lua path as a detection compensating control, though this is detective rather than preventive. Keep watching the vendor advisory and the reference repository at https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56083.md for an official firmware fix, and verify affected builds against the CPE list (Reyee OS 219/221, RG-YST250F, RG-EST310 V2, RG-EAP602) before assuming a single model upgrade is sufficient.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), i.e. classic shell-metacharacter injection. The affected component is the Lua-based web management backend of Ruijie's Reyee OS: the module_set parameter is passed into the handler /usr/local/lua/dev_sta/nbr_networkId_merge.lua, where the supplied value is concatenated into an operating-system command without adequate sanitization, letting the caller break out of the intended argument context and execute arbitrary shell commands with the privileges of the web server process. The CPE data shows the flaw is not confined to the single X30-PRO model named in the description: it maps to Ruijie RG-YST250F firmware 3.0(1)B11P280YST250F, RG-EST310 V2 firmware B11P221, Reyee OS builds 219 and 221, and RG-EAP602 firmware 3.0(1)B2P55, consistent with a shared Reyee OS codebase and utility/driver Lua modules reused across access points, bridges and wireless CPEs. Because the vulnerable path sits behind the authenticated management interface, the exploit surface is the device's own web/MQTT-style configuration API rather than any unauthenticated network service.
Know when Reyee Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable management endpoint (AV:N), straightforward injection (AC:L), requires an authenticated session (PR:L); OS command injection grants full device control, so C/I/A all High.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_networkId_merge.lua.
Executive ViewAI
Ruijie X30-PRO devices running firmware X30-PRO-V1_09241521 and related Reyee OS-based Ruijie networking equipment are affected by a high-severity command-injection weakness that an authenticated low-privilege user could exploit to execute arbitrary operating-system commands. No vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, so risk is serious but not top-tier emergency; organizations should reduce management-plane exposure while monitoring for exploitation. Leadership should care because compromise of these devices could undermine network confidentiality, integrity, and availability in branch, edge, or managed Wi-Fi environments.
No vendor-released patch identified at time of analysis; interim mitigations include restricting management/web UI access to trusted networks or a dedicated management VLAN, disabling WAN-facing administration, enforcing strong authentication and least privilege, removing or disabling unnecessary low-privilege accounts, monitoring for crafted POST requests to nbr_networkId_merge.lua/module_set, and segmenting affected X30-PRO-V1_09241521 and related Reyee OS devices to reduce exposure; monitor Ruijie for a fixed firmware release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)CVE.org
Authenticated remote attackers with low privileges can execute arbitrary OS commands on Ruijie RG-RAP2200(E) wireless ac
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's prox
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their
Authenticated command injection in Ruijie Reyee OS (and the affected RG-EW1800GX PRO, RG-EAP602, RG-EST310 V2 and RG-YST
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credent
Authenticated OS command injection in Ruijie Reyee OS firmware for wireless bridges and access points - including the RG
OS command injection in Ruijie wireless access point firmware based on Reyee OS - including RG-YST250F, RG-EST310 v2 and
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to subscribe to partial possibl
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses weak credential mechanism that could allow an atta
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could enable an attacker to correlate a device serial n
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to obtain the devices serial nu
Exploit-DB