Ruijie RG-BCR860 CVE-2025-56109

Exploitation requires network reachability to the device's LuCI web management interface and valid low-privilege authentication (CVSS PR:L), after which a crafted POST request to the action_wireless action in /usr/lib/lua/luci/control/admin/wireless.lua injects arbitrary OS commands (CWE-78). Limiting factors: an attacker must already hold working credentials (not unauthenticated), and the management interface must be reachable from the attacker's position - devices whose admin UI is not exposed to untrusted networks are substantially harder to reach. No user interaction is required (UI:N). Affected firmware versions are not specified in the available data.

Signals are largely consistent and point to a genuine but not top-tier emergency priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity OS command injection requiring low privileges and no user interaction, with full confidentiality/integrity/availability impact - consistent with authenticated command execution on an embedded router management interface (LuCI). Publicly available exploit code exists (GitHub PoC referenced), which raises practical risk. However, there is NO CISA KEV listing, so this is 'publicly available exploit code exists' - not confirmed active exploitation. EPSS is 3.05% (87th percentile): elevated relative to the average CVE but still a low absolute probability, suggesting exploitation is plausible but not yet widespread. No SSVC decision data was provided. The main tempering factor is PR:L - the CVSS vector indicates an authenticated attacker, so default-exposed, unauthenticated mass exploitation is not implied by the data. Net: a real priority for anyone running the affected Ruijie router, especially where the management interface is network-exposed, but the low real-world deployment footprint and authentication requirement argue against treating it as an internet-wide emergency.

An attacker who can reach the device's web management interface and holds low-privilege credentials sends a crafted POST request to the action_wireless handler in wireless.lua, injecting shell metacharacters into a parameter that is passed to an OS command. The injected commands execute on the router (typically with elevated/root privileges on such embedded LuCI-based systems), granting full device control. A public proof-of-concept for CVE-2025-56109 is available on GitHub, lowering the skill barrier.