Ruijie RG-EW1800GX PRO CVE-2025-56097

Exploitation requires an authenticated session on the device management interface (CVSS PR:L) and the ability to reach the HTTP management endpoint that routes to the module_set handler in /usr/local/lua/dev_config/config_retain.lua; the attacker then supplies a crafted POST parameter containing shell metacharacters that reach an OS command unsanitized. Limiting factors: valid low-privilege credentials (or a hijacked session) are needed, and the affected firmware builds must be running (confirmed: rg-ew1800gx_pro_firmware 3.0(1)B11P226 and rg-ew300n_firmware 3.0(1)B11P300). Management interfaces on home/SMB routers are typically LAN-facing by default, which further constrains remote reach unless remote administration is enabled.

Signals are largely consistent and point to a genuine but conditional priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw that nonetheless requires some privilege (PR:L), meaning an attacker must first be authenticated to the router's management interface. Per CVSS PR:L this is an authenticated attack, not an unauthenticated one. Publicly available exploit code exists (POC=YES), which raises practical exploitability, but there is no CISA KEV listing, so this is not confirmed actively exploited. EPSS of 2.57% (85th percentile) is moderately elevated relative to the overall CVE population and is broadly consistent with 'POC exists but no confirmed mass exploitation' - i.e., exploitation is plausible and above-average-likely but not yet observed at scale. No SSVC decision record was provided in the input, so automatable/exploitation/technical-impact cannot be stated from an authoritative framework. Net: a real, actionable issue (full command execution on the device) gated by the need for prior authenticated access to the router, rather than a drive-by unauthenticated takeover.

An attacker who has obtained low-privilege credentials or an authenticated session on the Ruijie RG-EW1800GX PRO web management interface sends a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua, injecting shell metacharacters that are passed to an OS command. Because public exploit code is available, the barrier to reproduction is low, and successful injection yields arbitrary command execution on the router with full confidentiality, integrity, and availability impact.