Ruijie RG-EW1200G PRO CVE-2025-56095

Exploitation requires network reachability to the device's management/web interface AND low-privilege authenticated access (CVSS PR:L), after which a crafted POST request to the module_set action in /usr/local/lua/dev_sta/nbr_cwmp.lua injects OS commands. Affected scope is specifically the Ruijie RG-EW1200G PRO across firmware V1.00/V2.00/V3.00/V4.00 (CPE also lists rg-eap602 firmware 3.0(1)B2P55). Limiting factors: this is NOT pre-authentication - an attacker needs valid (even low-level) credentials or exposed/default login, and the management interface must be reachable from the attacker's position; routers with management restricted to the LAN and strong credentials materially reduce exposure. No user interaction is required (UI:N).

This is a credible, actionable priority for anyone running the affected Ruijie hardware, though signals are moderately - not maximally - alarming. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity OS command injection requiring only low privileges, yielding full C:H/I:H/A:H impact (effectively root on an embedded router) for an 8.8 HIGH score. A public exploit/PoC exists (vendor-independent writeup on GitHub plus OneDrive artifacts), which raises practical risk. EPSS is 2.76% (86th percentile) - elevated relative to the overall CVE population but still an absolute low probability, consistent with a device-specific flaw that has a PoC but is not yet subject to mass automated exploitation. The CVE is NOT on CISA KEV, so there is no confirmed active exploitation. Signals are internally consistent: PR:L (authenticated) aligns with the description's authenticated POST to an administrative Lua handler, so this is not a fully pre-auth internet-wormable bug. Net: treat as a real patch-now item for exposed/affected devices, but it reads as a targeted-exploitation profile (PoC + authenticated access) rather than an imminent mass-exploitation event. No SSVC decision data was provided in the input.

An attacker with low-privilege authenticated access to the router's web/management interface (or who has obtained/guessed credentials, including common defaults) sends a crafted POST request to the module_set endpoint handled by /usr/local/lua/dev_sta/nbr_cwmp.lua, injecting shell metacharacters into a parameter that is passed to an OS command. The injected command executes with the router's (typically root) privileges, giving full device takeover. A public PoC and writeup for CVE-2025-56095 exist, lowering the skill required to reproduce the attack.