Ruijie RG-EW1800GX CVE-2025-56102

Exploitation requires reaching the device management interface and sending a crafted POST request to the module_get action served by /usr/local/lua/dev_sta/networkConnect.lua on the affected firmware (RG-EW1800GX B11P226 / RG-EW300R B11P301). Per the CVSS vector, PR:L means the attacker must hold some level of authentication to the router (not anonymous), which is the primary limiting factor; no user interaction (UI:N) and low complexity (AC:L) are needed. Practical exposure depends on whether the management interface is reachable from the attacker's position - typically LAN-side or via remote management if enabled - so devices with WAN-exposed admin interfaces or weak/default credentials are at materially higher risk than LAN-only, strongly-authenticated deployments.

This is a credible, above-average-priority issue for anyone operating the affected Ruijie SOHO routers, though not a top-tier internet-wide emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack that requires only low-level authentication and yields full C:H/I:H/A:H impact - consistent with OS command injection (CWE-78) granting command execution on the device. Reinforcing signals: a POC is publicly available, and EPSS of 2.57% at the 85th percentile is notably elevated relative to the average CVE, indicating meaningful real-world exploitation interest. Tempering signals: the flaw is NOT listed in CISA KEV, so there is no confirmed active exploitation, and the PR:L requirement means an attacker needs some valid authentication (or a session/default credential) rather than fully anonymous access. There are no directly conflicting signals in the data; the main gap is that KEV/SSVC exploitation-status and automatability fields are absent, so prioritization rests on POC existence plus the elevated-but-moderate EPSS. Net: treat as a prioritized patch for exposed devices, not a drop-everything zero-day.

An attacker with low-privileged access to the router's web/management interface (e.g., a logged-in user, default/weak credentials, or a foothold on the LAN) sends a crafted POST request to the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua, injecting shell metacharacters that are passed to an OS command. Because a public POC exists and attack complexity is low, this executes attacker-chosen commands on the device with full confidentiality, integrity, and availability impact. The result is effective takeover of the router, enabling traffic interception, pivoting, or botnet enrollment.