Ruijie RG-BCR860
CVE-2025-56111
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to RG-BCR860 web UI
-
DeliverySend crafted POST to network_set_wan_conf
-
ExploitInject shell metacharacters into WAN parameter
-
ExecutionExecute arbitrary OS commands
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session on the RG-BCR860 web management interface (CVSS PR:L) and the ability to reach that interface over the network; the specific trigger is a crafted POST request to the network_set_wan_conf endpoint implemented in /usr/lib/lua/luci/controller/admin/netport.lua. The limiting factors are the authentication requirement (a valid low-privilege credential or session is needed - this is not anonymous exploitation) and network reachability of the management interface, which should normally be restricted to trusted LAN/management segments. No end-user interaction is required (UI:N). Exploitation targets the specific affected firmware build 2.5.13-r2224. |
| Impact | This is a genuine elevated-priority issue for anyone operating the affected Ruijie RG-BCR860 router, though it stops short of worst-case 'remote unauthenticated' severity. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires some level of authentication (PR:L), so an attacker needs at least a low-privilege account or valid session on the web management interface - not pure anonymous access. Supporting signals align: a public exploit exists (POC=YES), and the EPSS score of 3.05% (87th percentile) is elevated relative to the CVE population, indicating above-average predicted exploitation likelihood despite not being extreme. The vulnerability is NOT listed in CISA KEV, so there is no confirmed active exploitation. No SSVC decision data was supplied in the input, so automatable/exploitation-status cannot be evaluated through that framework. Net: a high-impact (C:H/I:H/A:H, command injection yielding full device control), low-complexity flaw with a published POC and above-median EPSS, gated primarily by the PR:L authentication requirement - a real patch/mitigation priority for exposed devices, but the auth gate meaningfully limits mass-scanning exploitation compared to a PR:N flaw. |
| Exploit ScenarioDerived | An attacker with a low-privilege authenticated session on the RG-BCR860 web interface sends a crafted POST request to the network_set_wan_conf handler, injecting shell metacharacters into a WAN configuration parameter. Because input is passed to an OS command without sanitization (CWE-78), the attacker executes arbitrary commands on the router, gaining full control of the device. A public proof-of-concept exists, lowering the skill barrier for reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
OS command injection in the Ruijie RG-BCR860 router firmware (build 2.5.13-r2224) lets attackers with a valid low-privilege session on the web management interface execute arbitrary OS commands on the device by sending a crafted POST request to the network_set_wan_conf endpoint. The flaw resides in the LuCI controller file /usr/lib/lua/luci/controller/admin/netport.lua and carries a CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning authentication is required but no user interaction is needed. Publicly available exploit code exists (EPSS 3.05%, percentile 87%), but there is no CISA KEV confirmation of active exploitation at time of analysis; the practical risk is highest where the router's management interface is exposed beyond a trusted LAN segment.
RemediationAI
Vendor-released patch status for CVE-2025-56111 is not confirmed in the available input data - no fixed firmware version is cited, so operators should check Ruijie's support portal for an updated RG-BCR860 firmware release and upgrade from 2.5.13-r2224 as soon as one is published. Until a fix is applied, the most effective compensating control is to restrict access to the router's web management interface: bind it to a dedicated management VLAN or trusted LAN segment, block internet-facing and WAN-side access to the LuCI HTTP/HTTPS ports with firewall rules, and avoid exposing the GUI through port-forwarding, UPnP, or remote-management features - this eliminates the network reachability required by the CVSS AV:N vector, though it may hinder legitimate remote administration. Additionally, enforce strong, unique credentials and apply least privilege on any management accounts, since exploitation requires a valid low-privilege session (PR:L); note that credential hygiene alone does not remove the injection flaw. Monitor device logs for anomalous POST requests to network_set_wan_conf and treat any unexpected shell activity on the router as a potential compromise indicator. The public proof-of-concept in the flegoity GitHub report (CVE-2025-56111.md) should be used only for verification on authorized systems.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected device is a Ruijie RG-BCR860 router running firmware 2.5.13-r2224, which uses the OpenWrt-derived LuCI web framework; the vulnerable logic lives in the Lua controller at /usr/lib/lua/luci/controller/admin/netport.lua. This maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning user-controlled input from the network_set_wan_conf POST handler is passed to a shell invocation without adequate sanitization or escaping, allowing injected shell metacharacters to be interpreted as OS commands. The CVSS vector confirms network reachability (AV:N), low complexity (AC:L), a low-privilege prerequisite (PR:L), no user interaction (UI:N), and high confidentiality, integrity, and availability impact (C:H/I:H/A:H) - consistent with an authenticated attacker gaining full command execution on the embedded device.
Know when Rg Bcr860 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable LuCI endpoint with low complexity; a valid low-privilege session is required so PR:L, and command injection yields full device C/I/A compromise.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the network_set_wan_conf in file /usr/lib/lua/luci/controller/admin/netport.lua.
Executive ViewAI
A high-severity command injection flaw in the Ruijie RG-BCR860 router firmware (build 2.5.13-r2224) allows anyone holding a valid low-privilege web management login to run arbitrary operating system commands on the device, effectively handing them control of the hardware and any traffic it handles. Because no vendor patch is available and publicly available exploit code exists, any organization with these routers reachable outside a trusted LAN segment - remote offices, retail sites, or internet-exposed management interfaces - faces meaningful risk of a foothold that could be used to intercept or redirect network traffic. Leadership should treat affected units as untrusted until they are isolated or replaced, since the device itself cannot currently be hardened against this flaw.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict the web management interface to a trusted management VLAN or isolated admin network and block it from internet and broad-LAN access; remove unnecessary low-privilege accounts and rotate all management credentials; segment affected routers so a compromise cannot pivot into core networks; monitor and alert on POST requests to the network_set_wan_conf endpoint and on anomalous device outbound traffic; and plan replacement or upgrade to a supported model pending a vendor fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)CVE.org
More in Rg Bcr860 Firmware
View allOS command injection in Ruijie RG-BCR860 firmware lets an authenticated remote attacker execute arbitrary commands on th
Authenticated attackers with low-privilege access can execute arbitrary OS commands on Ruijie RG-BCR860 routers by sendi
OS command injection in Ruijie RG-BCR860 firmware allows authenticated attackers with network access to the LuCI web man
OS command injection in the Ruijie RG-BCR860 wireless router (firmware 2.5.13) lets an authenticated attacker execute ar
A vulnerability was found in Ruijie RG-BCR860 2.5.13 and classified as critical. Rated high severity (CVSS 7.2), this vu
Exploit-DB