Ruijie RG-BCR600W CVE-2025-56096

Exploitation requires the attacker to reach the RG-BCR600W web management interface and authenticate as at least a low-privilege user (PR:L), then issue a crafted POST request specifically to the restart_modules action implemented in /usr/lib/lua/luci/controller/admin/common.lua, embedding shell metacharacters that the handler passes to an OS command. Limiting factors: valid credentials or an authenticated session are needed (not pre-auth), and the management interface must be network-reachable to the attacker - so devices whose admin plane is exposed to untrusted networks or protected only by default/weak credentials are at materially higher risk, while those with admin access restricted to trusted LAN segments are largely protected.

This is a genuine, elevated-priority issue for anyone operating the affected device, though not an internet-wide emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity command injection that requires only low-level authenticated privileges and no user interaction, yielding full C:H/I:H/A:H impact - complete device compromise. EPSS is 1.98% (80th percentile): above-average exploitation probability but not extreme, consistent with a device-specific flaw rather than a mass-exploited internet service. There is NO CISA KEV listing and no explicitly flagged proof-of-concept in the input, so there is no confirmation of active exploitation. However, a third-party GitHub vulnerability report (flegoity) is referenced, which for this class of researcher disclosure frequently includes reproduction details - treat public technical detail as likely even though a PoC flag was not provided. The key tempering factor is PR:L: exploitation presupposes the attacker can already authenticate to the router's web management interface (even as a low-privilege user), which substantially narrows the realistic attacker population versus a PR:N unauthenticated bug. Net: a real, high-severity post-authentication RCE on a niche networking appliance - prioritize patching for exposed/managed fleets, but it does not carry the automatable, pre-auth, mass-exploitation profile of a top-tier emergency.

An attacker with valid (even low-privilege) credentials to the RG-BCR600W web interface - or who has obtained a valid session via default/weak credentials or CSRF-adjacent access - sends a crafted POST request to the restart_modules handler in common.lua, injecting shell metacharacters that are passed unsanitized to an OS command. The injected commands execute with the router's backend privileges, giving full control of the device. A GitHub disclosure report for this CVE is publicly referenced, so technical reproduction detail is likely available even though no PoC was explicitly flagged in the input.