Ruijie M18 CVE-2025-56089

Exploitation requires network access to the device management interface and low-privilege authentication (PR:L) to the affected Ruijie M18 EW (3.0(1)B11P226) / RG-EW300G Pro (EW_3.0(1)B11P219) firmware, after which a crafted POST request to the module_set function in /usr/local/lua/dev_sta/nbr_cwmp.lua injects shell commands via an unsanitized parameter. No user interaction is needed (UI:N). Limiting factors: the attacker must hold valid credentials or an authenticated session (the flaw is not unauthenticated), and the management interface must be reachable from the attacker's position; devices that do not expose management to untrusted networks substantially reduce real-world exposure.

This is a credible but not top-tier emergency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity attack that nonetheless requires low-level privileges (PR:L) - meaning the attacker needs valid, if low-privileged, authentication to the device management interface rather than fully unauthenticated access. Full C:H/I:H/A:H impact (command execution on an embedded router OS) justifies the 8.8 HIGH score. Supporting signals: a public exploit/PoC exists (raising practical exploitability) and EPSS is 2.84% at the 86th percentile - elevated relative to the average CVE but still an absolute low probability, suggesting known interest but not mass automated exploitation. There is no CISA KEV listing in the provided data, so there is no evidence of confirmed active in-the-wild exploitation. The combination of a working PoC, low attack complexity, and only a low-privilege authentication barrier makes this a real priority for exposed Ruijie M18/RG-EW300G Pro devices, but the authentication requirement and modest EPSS temper it below a 'drop-everything' unauthenticated RCE.

An attacker with low-privilege credentials (or access to a device exposing its management interface to the network) sends a crafted POST request to the module_set handler in /usr/local/lua/dev_sta/nbr_cwmp.lua, injecting shell metacharacters that the Lua code passes to an OS command. A publicly available PoC exists, lowering the skill barrier, and the low attack complexity (AC:L) means the request succeeds reliably against affected firmware, yielding arbitrary command execution on the router.