Ruijie Reyee OS
CVE-2025-56113
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device web/management interface
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitSend crafted POST to pwdmodify in common.lua
-
ExecutionInject OS command via unsanitized parameter
-
PersistExecute arbitrary commands on appliance
-
ImpactFull compromise of network device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to the device's LuCI-based web management interface and a valid low-privilege authenticated session (CVSS PR:L); the attacker then sends a crafted POST request to the pwdmodify function in /usr/lib/lua/luci/modules/common.lua, injecting shell metacharacters into an unsanitized parameter. Limiting factors: exploitation is not fully unauthenticated - it depends on obtaining at least low-level credentials (or exploiting default/weak logins) and reachability of the management interface, which in hardened deployments is restricted to a management VLAN or LAN rather than exposed to the internet. No user interaction is required. |
| Impact | This is a credible mid-tier priority rather than a critical fire-drill. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity command injection that requires only low-level authentication (PR:L) and no user interaction, yielding full confidentiality, integrity, and availability impact - consistent with OS command injection (CWE-78) running with device-level privileges. However, the exploitation-probability signals are modest: EPSS is 1.66% (76th percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced (the three links are vendor-independent vulnerability reports and file shares, not weaponized PoCs). The combination of high technical impact but low EPSS and no KEV listing suggests real but not yet widespread exploitation - a genuine authenticated RCE on embedded networking gear that attackers value, but currently without confirmed in-the-wild activity. Note the authentication requirement (PR:L) is the single biggest mitigating factor and is the main reason this is not treated as a wormable critical. No conflicting signals in the core data, though exact affected version boundaries are ambiguous (see confidence notes). |
| Exploit ScenarioDerived | An attacker who holds (or obtains via default/weak credentials) a low-privilege account on the device's web management interface sends a crafted POST request to the pwdmodify handler in /usr/lib/lua/luci/modules/common.lua, injecting shell metacharacters that are passed to an OS command. The injected command executes with the privileges of the LuCI/web backend, giving the attacker arbitrary command execution on the appliance. No public exploit code was identified at time of analysis, but the flaw is network-reachable and low-complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Authenticated OS command injection in Ruijie Reyee OS firmware for wireless bridges and access points - including the RG-YST250F, RG-EST310 V2, RG-EAP602 and related RG-YST/EST series devices running Reyee OS 219/221 builds - allows a low-privilege user who can reach the LuCI web management interface to execute arbitrary shell commands on the device by sending a crafted POST request that abuses the pwdmodify function in /usr/lib/lua/luci/modules/common.lua. Because the injected command runs with the privileges of the web server backend (typically root on these embedded platforms), a successful attacker gains full control of the device's confidentiality, integrity and availability, consistent with the assessed CVSS:3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no CISA KEV listing confirming active exploitation and EPSS is modest at 1.66% (76th percentile), but a public GitHub advisory repository documents the flaw along with reproduction detail, so the issue should be treated as a credible mid-tier priority rather than a critical fire-drill - most urgent for operators who have left the management interface reachable from untrusted networks or who still permit default or weak administrative credentials.
RemediationAI
No vendor-released patch is identified in the available data - the references consist of a third-party GitHub advisory and hosted OneDrive material rather than a Ruijie security bulletin with a fixed firmware build - so patch status should be tracked directly with Ruijie support and the Reyee OS release notes for the RG-YST250F, RG-EST310 V2, RG-EAP602 and other Reyee OS 219/221 devices. Until a fixed firmware image is confirmed and deployed, apply targeted compensating controls in this order: first, remove internet exposure of the LuCI web management interface entirely by disabling WAN-side/remote web administration and restricting HTTPS/HTTP management to a dedicated management VLAN or trusted LAN segment via firewall ACLs (trade-off: administrators lose remote convenience and must use VPN or on-site access, but this eliminates the AV:N prerequisite that makes the flaw remotely reachable); second, rotate all administrative credentials to strong, unique passwords and eliminate default or shared logins, since the attack requires at least a low-privilege authenticated session (PR:L) and default/weak credentials are the most common way that prerequisite is satisfied in the field (trade-off: no functional impact, but credential hygiene must be applied to every device, including mesh/repeater nodes that may inherit the same password); third, audit for indicators of compromise by inspecting device logs and any reverse-proxy/web logs for POST requests targeting the LuCI pwdmodify handler containing shell metacharacters (semicolons, backticks, pipes, $() or &&), and review /usr/lib/lua/luci/modules/common.lua for unauthorized modification, since injected commands run as root and may have installed persistence (trade-off: log retention on embedded devices is limited and may require an external syslog collector); fourth, segment IoT/WLAN infrastructure onto an isolated management network so a compromised access point cannot be used to pivot into core systems. Because EPSS is only 1.66% and there is no CISA KEV listing, these measures can be scheduled as a risk-based hardening program rather than an emergency outage, but any device confirmed reachable from the internet with usable credentials should be treated as compromised and re-imaged rather than simply patched.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected devices run Ruijie's Reyee OS, an OpenWrt-derived embedded Linux distribution, and expose a web management console built on LuCI - the Lua-based MVC web framework used by OpenWrt. The vulnerable code path is the shared helper module /usr/lib/lua/luci/modules/common.lua, specifically the pwdmodify (password modification) handler, which accepts user-supplied parameters from a POST request and passes them into a shell invocation without adequate sanitization or escaping; shell metacharacters therefore break out of the intended command and execute arbitrary OS commands. This is the classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) pattern, exacerbated in LuCI deployments where the CGI/backend service runs as root, so injected commands inherit full device privileges - enabling credential theft, configuration tampering, persistent implant installation, or use of the device as a network pivot. The CPE data maps the flaw across multiple firmware images: rg-yst250f_firmware 3.0(1)b11p280yst250f, rg-est310_v2_firmware b11p221, reyee_os 219 and 221, and rg-eap602_firmware 3.0(1)b2p55, indicating a shared LuCI codebase defect propagated across several RG-YST/EST/EAP hardware families rather than a single-model bug. The CVSS vector confirms network reachability (AV:N), low attack complexity (AC:L), a low-privilege authenticated prerequisite (PR:L), no user interaction (UI:N), and high impact to confidentiality, integrity and availability.
Know when Reyee Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable web endpoint (AV:N/AC:L), but a low-privilege authenticated session is needed (PR:L); OS command injection yields full device compromise (C/I/A:H) within the same security scope.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
OS Command Injection vulnerability in Ruijie RG-YST EST, YSTAP_3.0(1)B11P280YST250F V1.xxV2.xx allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua.
Executive ViewAI
A high-severity command injection vulnerability in Ruijie Reyee OS firmware for wireless bridges and access points (including RG-YST250F, RG-EST310 V2, RG-EAP602) allows an authenticated low-privilege user with network access to the web management interface to execute arbitrary commands as root. With no vendor-released patch identified at time of analysis and publicly available exploit code exists, organizations using these devices face potential full device compromise, which could disrupt wireless network operations, expose sensitive data, and enable lateral movement. Leadership should prioritize immediate mitigations because these devices are often deployed in critical network infrastructure.
No vendor patch available. Interim mitigations include: restricting management interface access to trusted IPs, disabling remote management, changing default credentials, segmenting affected devices on isolated VLANs, and monitoring for suspicious POST requests to the pwdmodify function.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)CVE.org
Authenticated remote attackers with low privileges can execute arbitrary OS commands on Ruijie RG-RAP2200(E) wireless ac
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's prox
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their
Authenticated command injection in Ruijie Reyee OS (and the affected RG-EW1800GX PRO, RG-EAP602, RG-EST310 V2 and RG-YST
OS command injection in Ruijie X30-PRO (firmware X30-PRO-V1_09241521) and related Reyee OS-based Ruijie devices allows a
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credent
OS command injection in Ruijie wireless access point firmware based on Reyee OS - including RG-YST250F, RG-EST310 v2 and
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to subscribe to partial possibl
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses weak credential mechanism that could allow an atta
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could enable an attacker to correlate a device serial n
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to obtain the devices serial nu
Exploit-DB