Ruijie M18
CVE-2025-56114
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to device management (PR:L)
-
DeliverySend crafted POST to module_set in config_retain.lua
-
ExploitInject shell metacharacters into OS command
-
ExecutionExecute arbitrary commands on device
-
ImpactFull device takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the device web/management interface and a valid low-privilege authenticated session (CVSS PR:L), after which a crafted POST request to the module_set endpoint handled by /usr/local/lua/dev_config/config_retain.lua injects OS commands. Limiting factors: the attacker must first obtain management-interface credentials or a session (PR:L, so not fully unauthenticated), and exposure depends on whether the management interface is reachable from the attacker's network segment (LAN by default on such routers/APs; higher risk if remote administration is enabled). No user interaction is required. Affected to the specific Ruijie firmware builds listed (RG-EW1300G ew_3.0(1)b11p303 and M18 EW 3.0(1)b11p226). |
| Impact | Signals are largely consistent and point to a credible but conditional priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicates network-reachable, low-complexity exploitation that requires some level of privilege (PR:L) and no user interaction, yielding full confidentiality, integrity, and availability impact - consistent with OS command injection granting command execution on the device. A public exploit/PoC exists (GitHub write-up referenced), which lowers the barrier to weaponization. EPSS is 2.57% (85th percentile): elevated relative to the average CVE but not indicative of mass exploitation, aligning with a PoC-available-but-not-yet-widely-weaponized state. This CVE is NOT in CISA KEV and there is no evidence of active exploitation. Net: a genuinely dangerous device-takeover bug on affected Ruijie firmware, but gated by the PR:L authentication requirement and by how exposed the management interface is - treat as high priority where these routers/APs have internet- or LAN-reachable admin interfaces, and as moderate elsewhere. No SSVC decision data was provided in the input, so automatable/technical-impact framing cannot be confirmed. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the device management interface sends a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua, injecting shell metacharacters that are passed to an OS command. The payload executes arbitrary commands in the device context, enabling full compromise of the router/access point. A public PoC write-up exists, reducing the effort required to reproduce the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
OS command injection in Ruijie M18 EW and RG-EW1300G router firmware allows a remote attacker holding a valid low-privilege management session (CVSS PR:L) to run arbitrary OS commands as the device through a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua. The assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) and the independent assessment agree that exploitation is conditional rather than fully unauthenticated: the attacker must first reach the web/management interface and obtain credentials or a session, with exposure highest where remote administration is enabled. Publicly available exploit code exists (a GitHub proof-of-concept/advisory repository), but there is no CISA KEV listing confirming active exploitation, and EPSS is 2.57% (85th percentile), indicating a credible but conditional priority.
RemediationAI
No vendor-released patch was identified in the available data at time of analysis; the only public reference is a third-party advisory/PoC repository (https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56114.md), so remediation currently depends on compensating controls. First, disable WAN/remote management and UPnP-based external exposure so the module_set endpoint is reachable only from a trusted LAN segment (trade-off: remote administration becomes unavailable and must be performed on-site or via VPN). Second, enforce strong, unique administrative credentials and change any default passwords, since exploitation requires a valid low-privilege session (PR:L) - this raises the bar but does not eliminate risk from an already-authenticated or compromised account. Third, segment IoT/consumer routers onto an isolated VLAN with egress filtering so that a successful command injection cannot reach other internal assets, accepting the added management complexity. Finally, monitor and alert on anomalous POST traffic to the module_set endpoint and on unexpected outbound connections or process activity from the device, and check with Ruijie for an updated firmware release for M18 EW 3.0(1)b11p226 and RG-EW1300G ew_3.0(1)b11p303 before relying on any specific fixed version.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-78 OS command injection in embedded Linux/Lua router firmware. Ruijie M18 and RG-EW1300G devices implement parts of their configuration and management logic in Lua scripts under /usr/local/lua/; the specific component is dev_config/config_retain.lua, which exposes a module_set operation reachable from the web management interface. When a crafted POST request is processed by module_set, attacker-controlled values are passed to a shell context without adequate sanitization or escaping, allowing injected OS commands to execute with the privileges of the management service (typically root on such firmware). CPE data scopes the affected builds to Ruijie m18-ew firmware 3.0(1)b11p226 and Ruijie rg-ew1300g_firmware ew_3.0(1)b11p303, matching the description's EW_3.0(1)B11P226_M18_10223116 build string. Because the vulnerable path is the router/AP management plane, exploitability is governed by whether the interface is reachable from the attacker's network segment and whether a session or credentials can be obtained; the provided CVSS vector confirms network attack (AV:N) with low privileges required (PR:L), and no user interaction (UI:N).
Know when Rg Ew1300G Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable management endpoint (AV:N), low complexity (AC:L), requires an authenticated low-privilege session (PR:L); command execution yields full C/I/A impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
Executive ViewAI
Ruijie M18 EW and RG-EW1300G routers - networking equipment commonly deployed at branch offices and small sites - carry a high-severity command injection flaw that lets someone with any valid management login take full control of the device. Because no vendor patch exists and exploit code is publicly circulating, any organization running these models with remote administration enabled faces a credible risk of full device compromise, network traffic interception, and a foothold into the wider corporate network. Leadership should care because the exposure is not theoretical, remediation depends on configuration changes rather than a patch, and affected devices are typically internet- or WAN-adjacent with minimal oversight.
No vendor-released patch identified at time of analysis. Interim mitigations: disable remote/WAN-side administration and restrict the management interface to a trusted internal management VLAN or jump host; block inbound management ports at the perimeter firewall; enforce least privilege and strong, unique credentials with rotation and MFA where supported; remove dormant or shared accounts to limit the exposure of the required low-privilege session; monitor for anomalous POST requests to the config_retain.lua module_set handler; and plan hardware replacement for devices that cannot be segmented and hardened, given that publicly available exploit code exists.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)CVE.org
More in Rg Ew1300G Firmware
View allOS command injection in the Ruijie RG-EW1300G router firmware (V1.00, V2.00, and V4.00) allows an attacker who holds val
OS command injection in Ruijie RG-EW1200G PRO router firmware (V1.00/V2.00/V3.00/V4.00, with the related RG-EW1300G also
A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 ser
Exploit-DB