Ruijie X30-PRO CVE-2025-56093

Requires authenticated low-privilege access (PR:L) to the Ruijie device's LuCI-based web management interface, from which the attacker sends a crafted POST request to the setWisp endpoint handled by /usr/lib/lua/luci/modules/wireless.lua; an unsanitized parameter is passed to an OS command, enabling injection (CWE-78). Limiting factors: valid credentials or an active authenticated session are needed (not unauthenticated), and the management interface must be reachable by the attacker; however, SOHO/SMB devices frequently run default or weak credentials and may expose management over LAN or WAN, which in practice erodes this limit. Affected builds include X30-PRO firmware X30-PRO-V1_09241521 and related RG-EW300 PRO and RG-EAP602 firmware per CPE data.

Signals are largely consistent and point to a genuine but conditional priority. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity attack that nonetheless requires low-level privileges (PR:L) - i.e. an authenticated session on the device web interface rather than fully unauthenticated access. Publicly available exploit code (confirmed by the exploit-tagged GitHub reference) materially lowers the barrier to weaponization. EPSS of 3.15% (88th percentile) is elevated relative to the overall CVE population but still modest in absolute terms, which is coherent with an authenticated SOHO/edge-device flaw affecting a regional vendor rather than an internet-wide unauthenticated bug. The CVE is NOT on CISA KEV and no SSVC decision data was supplied, so there is no confirmation of active in-the-wild exploitation. Net: a real, actionable issue for anyone running the affected Ruijie firmware (especially given default/weak credential practices on such gear), but the PR:L authentication requirement and the vendor's limited global footprint temper it below a drop-everything emergency. No internal signal conflicts were found; the main gap is the absence of KEV/SSVC data to distinguish targeted from widespread exploitation.

An attacker with low-privilege access to the device's web management interface (via default, weak, or phished credentials, or an exposed management port) sends a crafted POST request to the setWisp handler in wireless.lua, injecting shell metacharacters into an unsanitized parameter. The injected OS command executes with the privileges of the web backend, yielding arbitrary command execution on the device. Public exploit code exists, making this practical for low-skill attackers once authenticated.