Ruijie RG-EW1200 CVE-2025-56086

Requires authenticated access (PR:L) to the device management interface to reach the vulnerable module_get handler in /usr/local/lua/dev_sta/networkConnect.lua via a crafted POST request; exploitation is network-reachable and needs no user interaction. Limiting factors: the attacker must first obtain at least low-privilege credentials or a valid session, so exposure is materially higher where the web/management interface is internet-facing or protected only by default/weak credentials; impact is confined to the affected Ruijie RG-EW1200 (firmware 3.0(1)B11P227) and RG-X60 (firmware 3.0(1)B11P237) models.

This is a credible mid-tier priority rather than an emergency. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes remote, low-complexity exploitation requiring only low-level authentication (PR:L) and no user interaction, with total compromise of confidentiality, integrity, and availability - consistent with OS command injection (CWE-78) yielding device-level code execution. Signals partially reinforce each other: publicly available exploit code exists (POC), and the EPSS score of 2.91% sits at the 87th percentile - elevated relative to most CVEs, indicating above-average exploitation interest, but still an absolute probability under 3%. There is no CISA KEV listing, so there is no confirmation of active exploitation in the wild; POC availability and a moderately high EPSS percentile are distinct from confirmed exploitation and should not be conflated. The main mitigating factor is PR:L: an attacker needs valid (even low-privilege) credentials or an authenticated session to the device management interface, which tempers the 'network' vector. Net assessment: a real and patchable risk for exposed Ruijie consumer/SMB routers - especially where default or weak credentials or internet-exposed management are present - but not a mass-exploitation crisis absent KEV confirmation.

An attacker with low-privilege access to the router's web management interface (e.g., via default/weak credentials or an exposed management port) sends a crafted POST request to the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua, injecting shell metacharacters that are passed unsanitized to an OS command. This yields arbitrary command execution on the device, enabling full takeover. Public exploit code is available, lowering the barrier to reproduction.