Ruijie RG-BCR860 CVE-2025-56110

Exploitation requires the attacker to reach the device's HTTP/management API endpoint (the action_deal_update route in /usr/lib/lua/luci/controller/api/rcmsAPI.lua, part of the LuCI-based web interface) and to hold low-privilege authenticated access (CVSS PR:L), after which a crafted POST request injects OS commands. The primary limiting factor is the authentication requirement: an attacker needs valid credentials or an existing session on the router before the injection can be triggered. No special non-default configuration is indicated in the description; the vulnerable endpoint appears to be part of the standard firmware. Network exposure of the management interface (e.g., WAN-facing admin access) materially increases real-world risk.

This is a moderately high priority issue warranting prompt remediation, though not an emergency. The CVSS 3.1 base score of 8.8 (High) reflects a network-reachable (AV:N), low-complexity (AC:L) attack requiring only low privileges (PR:L) and no user interaction (UI:N), with full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) on an unchanged scope. Because PR:L is present, the attacker must first hold some authenticated foothold rather than being fully unauthenticated - this meaningfully limits mass exploitation. Supporting signals are mixed: publicly available exploit code exists (per the referenced GitHub report), which raises practical risk, but the EPSS score is only 3.05% (87th percentile) - elevated relative to the average CVE yet still well below the threshold typically associated with imminent widespread exploitation. The vulnerability is NOT listed in CISA KEV, so there is no confirmation of active in-the-wild exploitation. No SSVC decision data was supplied in the input. Net assessment: a real, actionable OS command injection with public PoC on a network device, but the authentication requirement and modest EPSS suggest targeted rather than opportunistic mass exploitation at this time.

An attacker with low-level authenticated access to the RG-BCR860's web management interface sends a crafted POST request to the action_deal_update handler in rcmsAPI.lua, injecting shell metacharacters into an unsanitized parameter that is passed to an OS command. A publicly available proof-of-concept exists, lowering the barrier to weaponization. Given the network attack vector and low complexity, successful injection yields arbitrary command execution on the underlying router OS.