Ruijie RG-EW1200G PRO CVE-2025-56090

Exploitation requires reaching the device management interface and sending a crafted POST request to the module_set function in /usr/local/lua/dev_config/config_retain.lua on affected Ruijie RG-EW1200G PRO firmware (V1.00/V2.00/V3.00/V4.00; CPE also lists RG-EW1200R firmware ew_3.0(1)b11p301). Per the CVSS vector (PR:L), the attacker must hold at least low-level authenticated access to the management interface - this is the primary limiting factor, meaning strong/changed admin credentials and restricting management-interface exposure (not reachable from WAN/Internet) materially reduce risk. No end-user interaction is required (UI:N), and attack complexity is low (AC:L).

This is a genuine high-priority vulnerability, though not a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-level authenticated privileges, with full high impact to confidentiality, integrity, and availability (C:H/I:H/A:H) - consistent with OS command injection (CWE-78) yielding device takeover on a router. Signals align: a public exploit exists (POC=YES) and the write-up/PoC artifacts are referenced, raising practical exploitability. EPSS is moderate at 2.91% (87th percentile) - elevated above baseline but not indicative of mass automated exploitation yet. The vulnerability is NOT listed in CISA KEV, so there is no confirmation of active in-the-wild exploitation; the available PoC indicates capability, not confirmed campaigns. The main limiting factor is PR:L: the attacker needs at least low-privilege authenticated access to the device management interface, which tempers the real-world risk for internet-exposed devices with changed default credentials, but is weak protection given routers frequently retain default/weak credentials and management interfaces are sometimes exposed. No SSVC decision data was provided in the input, so automatable/technical-impact framing cannot be independently stated. Net: a real, actionable priority for anyone running the affected Ruijie firmware, driven by public PoC plus full impact, but auth requirement and absence of KEV keep it below drop-everything urgency.

An attacker with low-privilege access to the Ruijie RG-EW1200G PRO web/management interface (e.g., via weak or default credentials, or an exposed management port) sends a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua, injecting shell metacharacters that are passed to an OS command. Because publicly available exploit code exists, this can be reproduced reliably, resulting in arbitrary command execution on the router, typically with elevated/root-level privileges.