Ruijie X30-PRO CVE-2025-56094

Exploitation requires the attacker to reach the device management interface over the network and send a crafted POST request to the module_get function in /usr/local/lua/dev_sta/host_access_delay.lua on affected Ruijie firmware (X30-PRO X30-PRO-V1_09241521 and RG-EW300 PRO 3.0(1)B11P219). Per the CVSS vector PR:L, at least low-privileged authentication to the device is needed, so this is not unauthenticated - valid, default, or weak credentials are the practical gating factor. No end-user interaction is required (UI:N). Exploitation is limited to these specific Ruijie router firmware builds and is most realistic where the management interface is reachable by the attacker and credentials are obtainable, which for most deployments means LAN-side or management-network access rather than arbitrary internet-wide reach unless the admin interface is exposed to the WAN.

This is a credible mid-to-high priority issue for the specific devices affected, but not a widespread emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring low-level authentication, with full high impact to confidentiality, integrity, and availability (C:H/I:H/A:H) - consistent with OS command injection (CWE-78) yielding device takeover. Supporting signals partly reinforce this: publicly available exploit code exists (a documented PoC on GitHub), and EPSS is elevated at 3.27% (88th percentile), which is high relative to the overall CVE population and reflects the public PoC, though still an absolute minority probability of exploitation in any given 30-day window. Crucially, this is NOT on CISA KEV, so there is no confirmed active exploitation - the PoC availability and active exploitation are distinct signals and should not be conflated. The PR:L requirement is the main mitigating factor: an attacker needs at least low-privileged authenticated access (e.g., a valid/default web login) rather than fully unauthenticated reach, which meaningfully constrains opportunistic mass exploitation. No SSVC decision data was provided in the input, so automatable/technical-impact framing cannot be independently stated. Net: a real and PoC-backed device-takeover flaw on a regional consumer/SMB router line, worth prompt patching for affected Ruijie fleets, but lacking the KEV/ubiquity profile of an internet-wide crisis.

An attacker with low-privileged access to the device's web/management interface (e.g., via default or weak credentials, or an authenticated user on the LAN) sends a crafted POST request to the module_get handler in /usr/local/lua/dev_sta/host_access_delay.lua, injecting shell metacharacters that are passed to an OS command. The injected commands execute with the router's privileges, granting full control of the device. A public proof-of-concept documenting this request is available on GitHub, lowering the barrier to reproduction.