Ruijie RG-EW1800GX CVE-2025-56106

Exploitation requires network access to the device management plane plus at least low-privilege authentication (CVSS PR:L) to the Ruijie RG-EW1800GX web/management interface, after which a crafted POST request to the 'module_set' endpoint handled by /usr/local/lua/dev_sta/nbr_cwmp.lua injects arbitrary OS commands. Limiting factors: the attacker must already hold a valid low-privilege session or credentials (default/weak credentials or session reuse would satisfy this), the management interface must be reachable from the attacker, and the affected firmware build (B11P226_EW1800GX_10223121 / 3.0(1)B11P226, and per CPE the RG-EST350 3.0(1)B11P221 build) must be in use. No end-user interaction is required (UI:N).

This is a credible, elevated-priority issue but not a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity exploitation that yields full device compromise, but the PR:L component means some level of authentication to the router is required - it is NOT an unauthenticated remote takeover. Publicly available exploit code exists (a GitHub write-up plus hosted PoC files), which lowers the barrier to opportunistic abuse. The EPSS score of 2.76% (86th percentile) is moderate - above average but far from the high-probability tier - which is consistent with a PoC-available, authentication-gated router bug rather than a mass-exploited, pre-auth flaw. This CVE is NOT listed in CISA KEV, so there is no confirmed active exploitation. No SSVC decision data was supplied in the input, so exploitation/automatable/technical-impact classifications cannot be cross-referenced. Net: the signals are internally consistent (authenticated command injection with working PoC, moderate EPSS, no KEV), pointing to a real but likely targeted/opportunistic risk against exposed or default-credential devices rather than widespread automated exploitation.

An attacker who can reach the router's management interface and possesses low-privilege credentials (or exploits default/weak credentials, or a victim's authenticated session) sends a crafted POST request to the module_set handler. Because input is passed unsafely to an OS shell in nbr_cwmp.lua, the attacker executes arbitrary commands and gains full control of the device. Publicly available exploit code (GitHub write-up and hosted PoC files) means a working attack path is already documented.