Ruijie Reyee OS CVE-2025-56084

Exploitation requires (1) network reachability to the device's HTTP management/CWMP interface and (2) valid authentication at low privilege (PR:L), after which the attacker sends a crafted POST request to the module_set endpoint handled by /usr/local/lua/dev_sta/nbr_cwmp.lua, where attacker-controlled input is passed to an OS shell without sanitization. Limiting factors that reduce real-world risk: valid credentials are needed (not unauthenticated), the management interface must be reachable by the attacker (devices with WAN-side admin disabled and segmented management LANs are far less exposed), and exploitation is tied to the specific affected Ruijie firmware builds/Reyee OS versions. The nbr_cwmp.lua path suggests the CWMP/TR-069 remote-management module, so environments with TR-069/CWMP enabled are the primary concern.

Signals are moderately-high but not emergency-tier. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network-reachable, low-complexity exploitation yielding full compromise, but the PR:L metric means a valid (even low-privilege) account on the device is required - this materially caps mass, unauthenticated scanning-driven exploitation. EPSS is 2.05% (81st percentile): elevated relative to the average CVE but far from the high-probability tier, consistent with a vuln that is interesting to attackers yet gated by authentication. The CVE is NOT in CISA KEV, so there is no confirmed active exploitation; publicly available exploit/technical reproduction details exist in a third-party GitHub researcher report. No SSVC decision data (exploitation status, automatable, technical impact) was provided, so an SSVC-based prioritization cannot be cross-checked here. Net: a genuine priority for anyone exposing these Ruijie device management interfaces to untrusted networks or using weak/default credentials, but the authentication prerequisite and absence of KEV listing make it a 'patch promptly' rather than 'drop everything' issue. Note a data discrepancy: the Description names the Ruijie RG-EW1800GX PRO, while the CPE list and Tags enumerate different models (RG-YST250F, RG-EST310 v2, RG-EAP602, Reyee OS) - verify the actual affected inventory with the vendor/reporter.

An attacker with network access to a Ruijie device's management interface and valid low-privilege credentials sends a crafted POST request to the module_set handler in /usr/local/lua/dev_sta/nbr_cwmp.lua, injecting shell metacharacters into an unsanitized parameter to execute arbitrary OS commands on the device (typically as root). Publicly available technical reproduction details exist in the referenced GitHub advisory, lowering the barrier to weaponization. The result is full device takeover enabling traffic interception, pivoting, or persistence.