Ruijie RG-BCR600W CVE-2025-56107

Exploitation requires reaching the RG-BCR600W web management interface and holding a low-privilege authenticated session (CVSS PR:L), then sending a crafted POST request to the submit_wifi action handled by /usr/lib/lua/luci/controller/admin/common_quick_config.lua, which passes attacker-controlled input into an OS command. Limiting factors: valid credentials (or access to an authenticated session) to the admin panel are required, so exploitation is gated by whether the management interface is network-reachable by the attacker and whether default or weak credentials allow obtaining the needed low-privilege account; no user interaction is required (UI:N) and complexity is low (AC:L). Practical risk is highest where the web UI is exposed to the internet or an untrusted LAN segment.

This is a credible, above-average priority for operators of the affected device, though not a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity command injection requiring only low-privilege authentication, yielding full C:H/I:H/A:H impact - consistent with OS command execution (CWE-78) on an embedded router, almost certainly as root given the LuCI/OpenWrt-style Lua controller path. Supporting signals diverge in magnitude: a public technical report exists on GitHub (raising practical exploitability), but there is NO CISA KEV listing and the EPSS score is only 2.25% (83rd percentile) - moderate relative ranking but low absolute probability, suggesting no observed widespread automated exploitation yet. The PR:L requirement is the main mitigating factor: an attacker needs valid (even unprivileged) credentials or a reachable, authenticated session to the web management interface, so exposure hinges heavily on whether the admin UI is internet-facing and whether default/weak credentials are in use - a very common weakness on SOHO routers that can effectively erode the PR:L barrier. No SSVC decision data was provided in the input. Net: a genuine high-severity flaw whose real-world risk is concentrated on devices with exposed or weakly-protected management interfaces rather than a broad, wormable threat.

An attacker with low-privilege access to the RG-BCR600W web management interface (or using default/guessed credentials on an internet-exposed panel) sends a crafted POST request to the submit_wifi handler in common_quick_config.lua, injecting shell metacharacters into an unsanitized parameter. The device executes the attacker's commands at the privilege of the web backend (typically root on such routers), granting full control. A public technical write-up documenting the vulnerable endpoint and request is available on GitHub, lowering the bar to reproduce it.