Ruijie Reyee OS
CVE-2025-56099
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to AP web interface (low-priv)
-
DeliverySend crafted POST to pwdmodify endpoint
-
ExploitInject OS command via common.lua
-
ExecutionExecute arbitrary commands on device
-
ImpactFull compromise of access point
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach the device's web management interface and possess at least low-privilege authenticated access (CVSS PR:L); from there a crafted POST request to the 'pwdmodify' function in /usr/lib/lua/luci/modules/common.lua injects arbitrary OS commands. Limiting factors: valid (even low-privilege) credentials are needed, so this is not unauthenticated, and realistic risk depends heavily on whether the management interface is network-exposed versus restricted to a trusted admin VLAN. No special non-default configuration is called out in the description - the vulnerable pwdmodify code path appears present in the affected firmware builds. |
| Impact | This is a genuine high-priority issue but short of emergency status. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity OS command injection yielding full confidentiality, integrity and availability impact - effectively device takeover. The key tempering signal is PR:L: exploitation requires some authenticated privilege level on the device, so this is not an unauthenticated internet-wide worm candidate. EPSS is 1.66% (76th percentile), which is moderate and above average but not indicative of mass automated exploitation, and the CVE is NOT on CISA KEV, so there is no confirmed active exploitation. A detailed third-party vulnerability report exists on GitHub (flegoity), which typically includes reproduction/technical detail, raising the practical exploitability above a purely theoretical flaw. Signals are largely consistent: high technical impact with a low-privilege authentication gate and no confirmed in-the-wild use. Net: prioritize patching on exposed/shared-admin Ruijie deployments, but the PR:L gate and absence of KEV listing suggest targeted rather than widespread exploitation risk. |
| Exploit ScenarioDerived | An attacker who has obtained low-privilege authenticated access to a Ruijie access point's web management interface (or who is positioned on the management network with valid credentials) sends a crafted POST request to the 'pwdmodify' handler in /usr/lib/lua/luci/modules/common.lua. The injected OS command executes with the privileges of the web backend, granting arbitrary command execution and full device control. A public technical report for this CVE exists on GitHub, lowering the effort required to reproduce the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
OS command injection in Ruijie wireless access point firmware based on Reyee OS - including RG-YST250F, RG-EST310 v2 and RG-EAP602 builds - lets an authenticated attacker with low-privilege management credentials execute arbitrary operating-system commands on the device via a crafted POST request to the pwdmodify handler in /usr/lib/lua/luci/modules/common.lua. The flaw rates CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78), and EPSS is 1.66% (~76th percentile), indicating meaningful but not top-tier exploitation likelihood; no public exploit code or confirmed actively exploited status (CISA KEV) was identified at time of analysis. Practical risk depends heavily on whether the web management interface is exposed beyond a trusted admin VLAN, since valid credentials are a prerequisite.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must initially focus on reducing exposure of the vulnerable management endpoint. Restrict the web management interface to a dedicated trusted admin VLAN and block it from the WAN and from user/guest network segments; this is the single most effective control because exploitation requires reaching the LuCI web service, but it means the device can no longer be administered remotely without VPN or jump-host access. Ensure all management accounts use strong, unique passwords and remove or disable unused low-privilege accounts, since the flaw needs only low-privilege credentials; the trade-off is added administrative overhead for credential rotation. Where the interface must remain reachable, front it with a reverse proxy or access-control rule that only permits known administrator source addresses and inspects POST bodies to the pwdmodify path, accepting the risk that such filtering can be bypassed by encoding tricks. Monitor device and upstream logs for unexpected POST requests to the LuCI password-change endpoint and for outbound connections or shell activity originating from APs, and isolate affected APs on a segmented management network pending a fix. Track the vendor for a Reyee OS/RG-YST250F firmware update and consult the referenced report at the GitHub link above for any updated mitigation guidance before re-enabling broad management access.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected devices run Ruijie's Reyee OS, an OpenWrt-derived networking firmware whose web management layer is built on LuCI, the standard Lua-based configuration framework bundled with OpenWrt. The vulnerability is an instance of CWE-78 (Improper Neutralization of Special Elements used in an OS Command), occurring in the 'pwdmodify' routine that handles password-change operations inside /usr/lib/lua/luci/modules/common.lua. Because the LuCI handler passes user-influenced request fields into a shell invocation, an attacker who can submit a POST request to that endpoint can append or inject shell metacharacters that are evaluated by the underlying OS, granting command execution in the context of the web service. The CPE data enumerates the specific affected builds: Ruijie RG-YST250F firmware 3.0(1)B11P280YST250F, RG-EST310 v2 firmware B11P221, Reyee OS builds 219 and 221, and RG-EAP602 firmware 3.0(1)B2P55. The parameters are network-reachable (AV:N), require low privileges (PR:L), need no user interaction (UI:N), and yield high confidentiality, integrity and availability impact, reflecting that OS-level command execution on a network device can expose stored credentials, configuration and traffic-handling logic and can be used as a pivot into the wider network.
Know when Reyee Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable web endpoint (AV:N/AC:L); a low-privilege authenticated session is required to reach pwdmodify (PR:L); command injection yields full device control (C:H/I:H/A:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
OS Command Injection vulnerability in Ruijie RG-YST AP_3.0(1)B11P280YST250F allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua.
Executive ViewAI
Ruijie Reyee OS wireless access points (including RG-YST250F, RG-EST310 v2, and RG-EAP602 builds) contain a high-severity OS command injection flaw in the web management interface that allows anyone holding valid low-privilege management credentials to run arbitrary commands on the device. Because these devices typically sit at the wireless edge, a compromised unit can serve as a foothold for lateral movement into trusted internal networks. Leadership should care because no vendor patch is currently available, so exposure must be reduced through network and credential controls until Ruijie publishes a fix.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict the web management interface to a dedicated, tightly controlled management VLAN and block it from user, guest, and internet-facing networks; remove any public or NAT-exposed administrative access; rotate and strengthen management credentials and eliminate shared/default accounts; apply AAA/RADIUS authentication where supported; log and monitor administrative and /pwdmodify requests for anomalous activity; and segment wireless access points so a single compromised device cannot reach sensitive internal systems. Pursue a fixed firmware build directly with Ruijie.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)CVE.org
Authenticated remote attackers with low privileges can execute arbitrary OS commands on Ruijie RG-RAP2200(E) wireless ac
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's prox
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their
Authenticated command injection in Ruijie Reyee OS (and the affected RG-EW1800GX PRO, RG-EAP602, RG-EST310 V2 and RG-YST
OS command injection in Ruijie X30-PRO (firmware X30-PRO-V1_09241521) and related Reyee OS-based Ruijie devices allows a
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credent
Authenticated OS command injection in Ruijie Reyee OS firmware for wireless bridges and access points - including the RG
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to subscribe to partial possibl
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses weak credential mechanism that could allow an atta
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could enable an attacker to correlate a device serial n
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to obtain the devices serial nu
Exploit-DB