Ruijie X30 Pro CVE-2025-56092

Exploitation requires reaching the router's web management service and sending a crafted POST request to the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua, which passes attacker-controlled input into an OS command. The CVSS PR:L metric indicates at least low-privileged authentication is needed, so the attacker must have a valid (or default/weak) session on the device's management interface; it is not an unauthenticated flaw. The primary limiting factors are this authentication requirement and network reachability of the management interface - exposure is substantially reduced when the web admin interface is not reachable from untrusted networks and default credentials have been changed. No user interaction is required (UI:N).

This is a genuinely actionable finding but likely of targeted rather than mass-exploitation concern. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-reachable, low-complexity exploitation requiring some authentication (PR:L), with full High impact to confidentiality, integrity, and availability - consistent with OS command injection (CWE-78) yielding device takeover. Publicly available exploit code raises the practical risk and lowers the bar for opportunistic attackers. However, signals partially conflict on reach: EPSS is only 2.76% (86th percentile - elevated but not high), and there is no CISA KEV listing, suggesting no confirmed widespread active exploitation despite the available POC. The PR:L requirement is a meaningful mitigant - an attacker needs at least low-privileged authenticated access (e.g., a valid/default user session on the router web interface) before reaching the vulnerable module_get handler. No SSVC decision data was provided in the input, so automatable/exploitation status under that framework cannot be stated. Net: treat as a high-priority patch target for anyone running the affected Ruijie firmware, especially where the management interface is network-exposed or default credentials are in use, but the absence of KEV and modest EPSS argue against assuming indiscriminate internet-wide exploitation.

An attacker with low-privileged authenticated access to the Ruijie X30 PRO web management interface sends a crafted POST request to the module_get function in /usr/local/lua/dev_sta/networkConnect.lua, injecting shell metacharacters into an unsanitized parameter. The injected OS commands execute on the router with the web service's privileges, giving the attacker control over the device. Publicly available exploit code exists, further lowering the effort required.