Ruijie RG-EW1200 CVE-2025-56085

Exploitation requires network reachability to the device's web/management interface AND low-privilege authentication (CVSS PR:L), after which the attacker sends a crafted POST request targeting the module_set parameter processed by /usr/local/lua/dev_config/config_retain.lua on affected Ruijie RG-EW1200 (firmware 3.0(1)B11P227) and RG-EW300 Pro (firmware 3.0(1)B11P219) devices. The specific prerequisite is the ability to reach and submit to the config_retain.lua configuration-retention handler as an authenticated user; the primary limiting factor is that valid (even low-level) credentials are needed, so it is not exploitable fully unauthenticated - though exposed management interfaces and default/weak credentials on consumer routers can lower this barrier in practice. No special non-default feature toggle is indicated in the description.

This is a genuine elevated-priority issue for anyone operating the affected Ruijie SOHO routers, though not an emergency across the broad internet. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity attack requiring only low-level authentication, yielding full confidentiality, integrity, and availability impact - consistent with OS command injection (CWE-78) granting command execution on the device. Reinforcing this, publicly available exploit code exists and the EPSS score of 2.92% sits in the 87th percentile, which is comparatively high and reflects the published POC and ease of exploitation. However, the vulnerability is NOT listed in CISA KEV, so there is no confirmed active exploitation - the signals point to a credible, easily weaponizable flaw rather than one proven to be used in the wild. The key mitigating factor is PR:L: the CVSS vector states valid (low-privilege) authentication is required, so this is not an unauthenticated drive-by. On consumer routers, though, default or weak credentials and exposed management interfaces can effectively erode that barrier. Net assessment: a real priority to patch for owners of these devices, driven by POC availability and high EPSS, but tempered by the authentication requirement and absence of KEV/wild-exploitation confirmation.

An attacker with low-privilege access to the router's management interface (e.g., valid or default credentials, or a reachable exposed admin panel) sends a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua, injecting shell metacharacters that the device executes as OS commands. Because a public POC exists, exploitation is straightforward and repeatable, giving the attacker command execution to fully compromise the router, pivot into the internal network, or add persistence. The CVSS AV:N/AC:L vector confirms this is remotely reachable with low complexity once the low-privilege authentication condition is met.