Ruijie X30-PRO CVE-2025-56098

Exploitation requires the attacker to reach the device's web management interface and send a crafted POST request to the module_get function in /usr/local/lua/dev_sta/networkConnect.lua, injecting OS command metacharacters. The CVSS vector's PR:L indicates a low-privilege authenticated session is needed, so an attacker must possess or obtain valid (even unprivileged) credentials or an authenticated session to the router - this is the primary limiting factor and means default-credential or exposed-management-interface scenarios are the realistic enablers. No user interaction is required (UI:N). Risk is amplified where the management interface is exposed to untrusted networks or the Internet; it is constrained to the specific Ruijie X30-PRO (firmware X30-PRO-V1_09241521) and RG-EW300 Pro firmware builds identified in the CPEs.

This is a credible operational priority, though not a top-tier emergency. The CVSS 3.1 base score of 8.8 is driven by a fully remote network vector (AV:N), low attack complexity (AC:L), and complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) - consistent with OS command injection (CWE-78) that typically yields code execution with the web service's privileges on an embedded router. The one meaningful brake is PR:L: the vector indicates the attacker needs some level of authentication, so this is not a zero-interaction unauthenticated takeover. Publicly available exploit code exists (POC=YES), which materially raises real-world risk by lowering the skill barrier. EPSS reinforces a measured view: 2.57% (85th percentile) is elevated relative to the average CVE but still a low absolute probability, suggesting observed/predicted exploitation activity is not yet widespread. The vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. Net: a network-reachable, low-complexity RCE with public exploit code on consumer/SMB networking gear - treat as high priority to patch where these devices are exposed, but the PR:L requirement and absence of KEV temper it below a drop-everything unauthenticated-wild-exploitation scenario. No SSVC decision data was provided in the input.

An attacker with low-privilege access to the router's management interface sends a crafted POST request to the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua, injecting shell metacharacters into a parameter that is passed to an OS command. The injected command executes with the web service's privileges on the device, granting arbitrary command execution. Public exploit code for this flaw is available, lowering the effort required to reproduce the attack.