Ruijie RG-EW1800GX CVE-2025-56091

Exploitation requires the attacker to reach the device's web/management interface and submit a crafted POST request to the module_set endpoint handled by /usr/local/lua/dev_config/config_retain.lua. Per CVSS PR:L, a low-privilege authenticated session is required (not unauthenticated), so the attacker needs valid, low-level credentials or access to a weak/default login - this is the primary limiting factor. No user interaction is required (UI:N) and attack complexity is low (AC:L). Exploitation applies to the specific firmware builds RG-EW1800GX B11P226 (3.0(1)B11P226) and RG-EW300R (3.0(1)B11P301); other versions/platforms are not confirmed affected. Internet-exposed management interfaces materially increase real-world risk.

This is a credible, actionable priority but not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity OS command injection requiring only low-level authentication, with total compromise impact (C:H/I:H/A:H) - consistent with CWE-78 yielding device takeover. Publicly available exploit code exists (GitHub writeup plus two hosted exploit files), which materially lowers the barrier to attack. However, this is NOT in CISA KEV, so there is no confirmed active exploitation. EPSS is 2.91% (87th percentile) - elevated relative to the average CVE and consistent with public POC availability, but still a low absolute probability, suggesting opportunistic rather than confirmed widespread exploitation. The key tension: CVSS 8.8 and a public POC argue for prompt patching, while the PR:L requirement (authentication needed) and absence of KEV listing temper the real-world urgency. No SSVC decision data was provided in the input, so automatable/exploitation-status fields could not be cross-referenced. Net: treat as a high priority for exposed/internet-facing Ruijie routers given the public exploit, but the authentication prerequisite means it is not a trivial unauthenticated mass-exploitation bug.

An attacker with low-privilege credentials (e.g., a standard device account or default/weak login) on a reachable Ruijie RG-EW1800GX router sends a crafted POST request to the module_set handler in config_retain.lua, injecting shell metacharacters that the device executes as OS commands. Because public exploit code exists (GitHub PoC and hosted exploit files), the attack is reproducible with minimal effort, resulting in arbitrary command execution and full control of the router.