Ruijie X30-PRO CVE-2025-56108

Exploitation requires network access to the device's web management interface AND a valid low-privilege authenticated session (CVSS PR:L), after which a crafted POST request to the pwdmodify function handled by common.lua triggers injection of OS commands. No user interaction is needed (UI:N). Limiting factors: the attacker must first obtain credentials or an authenticated session, and the management interface must be reachable - devices whose admin interface is not exposed to attacker-controlled networks (e.g., LAN-only or firewalled management) substantially reduce exposure. Applies to the listed Ruijie firmware builds (X30-PRO X30-PRO-V1_09241521 and related RG-EAP602/RG-EST350/RG-EW300 PRO/RG-EST310 firmware per CPE).

Signals are largely consistent and point to a genuine, actionable risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication, with full C:H/I:H/A:H impact - appropriate for an OS command injection on an embedded network device where injected commands typically run with high/root privileges. Publicly available exploit code (including a detailed write-up and PoC on GitHub) meaningfully lowers the barrier to weaponization. EPSS of 2.66% (85th percentile) is moderate-to-elevated relative to the overall CVE population, indicating above-average but not extreme near-term exploitation likelihood. This CVE is NOT in CISA KEV, so there is no confirmation of active in-the-wild exploitation; the PoC availability and KEV absence together suggest opportunity exists but widespread automated exploitation is not yet confirmed. The main caveat limiting raw risk is PR:L - exploitation requires valid (even if low-privilege) credentials or an authenticated session to the device management interface, so this is not a pure pre-auth remote flaw. For organizations running the affected Ruijie devices with management interfaces exposed, this is a real patching priority; for others it is lower due to limited deployment footprint.

An attacker with low-privilege authenticated access to the Ruijie device's web management interface sends a crafted POST request to the pwdmodify handler, injecting shell metacharacters into a parameter processed by common.lua. A public PoC and write-up exist, so the request format is documented; the injected command executes on the device, giving the attacker command execution (typically root) on the access point/router.