Ruijie RG-BCR600W CVE-2025-56087

Exploitation requires network reachability to the device's LuCI-based web management interface and a low-privilege authenticated session (CVSS PR:L), after which a crafted POST request to the run_tcpdump action in /usr/lib/lua/luci/controller/admin/common_tcpdump.lua injects OS commands through the tcpdump invocation. The specific prerequisite is the ability to invoke the admin common_tcpdump 'run_tcpdump' feature; the limiting factor is the need for valid credentials/a logged-in session rather than fully unauthenticated access, so risk rises sharply where default or weak admin/operator credentials are in use. No user interaction is required (UI:N).

This is a credible, elevated-priority issue but not a top-tier emergency based on current signals. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring only low-privilege authentication, with full high impact to confidentiality, integrity, and availability (C:H/I:H/A:H) - consistent with OS command injection yielding command execution on the router. Signals are broadly consistent rather than conflicting: EPSS of 2.44% (84th percentile) indicates above-average but not extreme predicted exploitation likelihood, which aligns with a publicly available exploit write-up existing while there is no CISA KEV listing and no evidence of mass exploitation. No SSVC decision data was provided in the input, so exploitation-status/automatable/technical-impact cannot be stated from an authoritative framework here. The main caveat: PR:L means an attacker needs some authenticated access to the device (e.g., a valid or default web-interface credential), which meaningfully limits drive-by mass exploitation versus a true unauthenticated flaw - verify whether default/weak credentials are common on this model, as that would materially raise real-world risk.

An attacker with low-privilege access to the RG-BCR600W web management interface (reachable over the network) sends a crafted POST request to the run_tcpdump handler, injecting shell metacharacters into a parameter that is passed unsanitized to an OS command. This executes arbitrary commands on the router, likely with elevated/root privileges. A public vulnerability report with exploitation details exists (publicly available exploit code exists), lowering the barrier to weaponization.