Ruijie M18 CVE-2025-56101
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach web management interface
-
DeliveryAuthenticate with low-privilege or default credentials
-
ExploitSend crafted POST to module_get in networkConnect.lua
-
ExecutionInject shell metacharacters into OS command
-
PersistExecute arbitrary commands on device
-
ImpactFull device compromise (C/I/A)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the device's web/management interface and low-privilege authentication (CVSS PR:L), after which a crafted POST request to the module_get function in /usr/local/lua/dev_sta/networkConnect.lua injects arbitrary OS commands. The limiting factors are: (1) the management interface must be reachable by the attacker - risk is far higher if it is internet-exposed rather than LAN-only; and (2) valid low-level credentials are needed, though weak/default/shared credentials common on SOHO routers may substantially lower this barrier. Affected builds are specific Ruijie firmware versions (M18 EW 3.0(1)B11P226 and RG-EW1200R EW_3.0(1)B11P301); other products/versions are not implicated by the provided data. |
| Impact | This is a credible, moderately-high priority issue rather than an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity attack that requires only low-level authenticated privileges and no user interaction, yielding full compromise (High C/I/A) of the device - consistent with an OS command injection (CWE-78) that runs arbitrary commands with the web management process's privileges. Reinforcing signals: a public exploit/PoC exists (GitHub advisory with reproduction steps), and EPSS is 2.76% at the 86th percentile - elevated relative to the average CVE and consistent with available exploit code, though not indicative of mass exploitation. The vulnerability is NOT in CISA KEV, so there is no evidence of confirmed active exploitation; status is 'publicly available exploit code exists,' which is distinct from in-the-wild use. The one genuine tension is PR:L: the CVSS requires some authentication, yet many SOHO/SMB routers ship with weak, default, or shared credentials, so the practical barrier may be lower than PR:L implies - verify default-credential posture for the affected Ruijie models. Net: prioritize patching/mitigation for any exposed management interfaces, but absence from KEV and only moderate EPSS argue against emergency same-day response unless the device's admin interface is internet-facing. |
| Exploit ScenarioDerived | An attacker with low-privileged access to the device's web management interface (or valid/default credentials) sends a crafted POST request to the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua, injecting shell metacharacters that are passed unsanitized to an OS command. Because AC:L and no user interaction are required, exploitation is reliable and scriptable, and a public PoC is already available on GitHub, lowering the effort needed to weaponize it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Authenticated OS command injection in Ruijie M18 (EW 3.0(1)B11P226) and RG-EW1200R (EW_3.0(1)B11P301) router firmware lets a remote attacker with low-privilege credentials execute arbitrary commands on the device by sending a crafted POST request to the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua. Publicly available exploit code exists (a GitHub vulnerability report with technical details), though there is no CISA KEV confirmation of active exploitation; EPSS estimates a 2.76% chance of exploitation within 30 days (86th percentile). Exploitation requires network reachability to the router's web management interface and valid low-privilege credentials, but default or weak SOHO router passwords may lower that barrier, making this a credible moderately-high priority issue.
RemediationAI
No vendor-released patch or fixed firmware version was identified in the provided data at time of analysis, so mitigation must rely on compensating controls. Immediately restrict access to the router's web management interface to trusted LAN segments only by disabling WAN/remote administration and any UPnP port-forwarding that exposes the UI, accepting the trade-off that remote management becomes unavailable; also replace default or weak administrative credentials with strong, unique passwords on all accounts and enforce least privilege for any low-privilege users that could reach the interface, since the exploit requires authentication. If the device shares a network with untrusted users, isolate it on a separate VLAN or place it behind a firewall that blocks inbound POST requests to /usr/local/lua/dev_sta/networkConnect.lua from untrusted sources. Monitor router logs for unusual POST requests to the module_get endpoint and for child process spawning from the web server, recognizing that such detections may be noisy and require tuning. Periodically check the vendor and the linked advisories (https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56101.md and the OneDrive references cited by NVD) for an official firmware update.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-78 OS command injection, where user-supplied input is passed to a system shell without adequate sanitization from a Lua-based web management module. Affected devices run Ruijie EW firmware (CPE: cpe:2.3:o:ruijie:m18-ew_firmware:3.0(1)b11p226 and cpe:2.3:o:ruijie:rg-ew1200r_firmware:ew_3.0(1)b11p301), and their management web UI exposes a module_get function inside /usr/local/lua/dev_sta/networkConnect.lua. A crafted POST request to that endpoint allows an attacker with network access (AV:N) and low-privilege authentication (PR:L) to inject and execute arbitrary OS commands as the underlying system user, with no user interaction (UI:N) and no scope change (S:U); the CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity, and availability impact. Public exploit code and a detailed vulnerability report are available, but the issue is not confirmed as actively exploited in the wild.
Know when Rg Ew1200R Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable management endpoint (AV:N), reliable injection (AC:L), requires low-privilege authentication per the described POST handler (PR:L); OS command execution yields full High C/I/A on the device.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
Executive ViewAI
Ruijie M18 (EW 3.0(1)B11P226) and RG-EW1200R (EW_3.0(1)B11P301) wireless routers, commonly deployed in small offices, retail branches, and home-office environments, can be induced to run attacker-supplied commands by anyone holding valid low-privilege device credentials, giving an intruder full control of a device that sits at the network edge. Because these units route and filter traffic for every user and system behind them, a compromised router exposes business communications, connected endpoints, and any trust relationships built on that network segment. No vendor-released patch is identified at time of analysis and publicly available exploit code exists, so leadership should treat this as a near-term exposure-management and network-isolation problem rather than a routine firmware update.
No vendor-released patch identified at time of analysis. Interim mitigations: remove the router web management interface from internet exposure and disable WAN-side remote management; restrict management access to a dedicated administrative VLAN or jump host with source-IP allowlisting; eliminate default credentials and enforce unique, strong passwords for all administrative and low-privilege accounts; monitor and alert on POST requests to the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua; segment affected routers so that compromise cannot propagate to corporate systems; and replace or retire units that cannot be isolated. Exploitation requires network reachability to the management interface plus valid low-privilege credentials, so credential hygiene and exposure reduction materially lower risk.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)CVE.org
More in Rg Ew1200R Firmware
View allRuijie Networks RG-EW1200 Wireless Routers EW_3.0(1)B11P204 was discovered to contain a command injetion vulnerability v
Authenticated OS command injection in Ruijie RG-EW1200G PRO wireless routers (firmware V1.00, V2.00, V3.00 and V4.00) al
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 ser
Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW_3.0(1)B11P204
Exploit-DB