Ruijie RG-BCR860 CVE-2025-56088

Exploitation requires network access to the RG-BCR860 device management interface AND valid authentication at low privilege (PR:L), after which a crafted POST request to the action_service action in /usr/lib/lua/luci/controller/admin/service.lua triggers OS command injection (CWE-78). The key limiting factor is that this is NOT unauthenticated - an attacker must first possess or obtain credentials to the LuCI admin web service, so risk concentrates on devices with weak/default/shared credentials or whose management interface is exposed to untrusted networks. No special non-default feature toggle is indicated in the description; the vulnerable controller appears to be part of the standard admin service. No user interaction is required (UI:N).

This is a credible but not top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity OS command injection requiring only low-level authenticated privileges, yielding full confidentiality/integrity/availability impact (C:H/I:H/A:H) - consistent with a CWE-78 flaw in a LuCI web controller. Publicly available exploit code exists (per the referenced GitHub write-up), which raises practical risk, and the EPSS score of 3.46% at the 89th percentile indicates above-average but not extreme predicted exploitation activity. The vulnerability is NOT in CISA KEV, so there is no confirmation of active in-the-wild exploitation - the signals align as 'public PoC + moderate-high EPSS, no confirmed active exploitation.' The main tempering factor is PR:L: exploitation requires valid (even if low-privilege) authentication to the device, meaning this is not a pure unauthenticated takeover. Net: a real priority for anyone operating RG-BCR860 devices, especially internet-exposed management interfaces, but the authentication requirement and absence of KEV listing suggest it is not yet subject to mass automated exploitation.

An attacker who has valid low-privilege credentials (or obtained them via default/weak passwords) to the RG-BCR860 management web interface sends a crafted POST request to the action_service endpoint in service.lua, injecting shell metacharacters that are passed to an OS command. Because a public PoC exists, the payload and endpoint are documented, lowering the skill needed. Successful injection executes arbitrary commands with the privileges of the LuCI/web backend, typically leading to full device compromise.