Ruijie X30-PRO CVE-2025-56117

Exploitation requires authenticated access at a low privilege level (CVSS PR:L) to the Ruijie X30-PRO management service, after which a single crafted POST request to the 'module_set' operation handled by /usr/local/lua/dev_sta/nbr_cwmp.lua injects attacker-controlled input into an OS command. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The primary limiting factors are the need for valid (even low-level) credentials and network reachability of the management interface - devices whose administrative interface is not exposed to untrusted networks substantially reduce real-world exposure. The nbr_cwmp.lua path suggests the handler is associated with CWMP/TR-069 neighbor-device functionality, so deployments using that management plane are most relevant.

Signals are largely consistent and point to a genuine but second-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity command injection requiring only low-privilege authentication, with full impact to confidentiality, integrity and availability - appropriate for an OS command injection (CWE-78) that typically yields code execution as the device service account. A public POC exists (GitHub advisory by researcher 'flegoity'), which raises practical risk since a working reproduction lowers the bar for attackers. However, EPSS is only 3.05% (87th percentile) - elevated versus the median but not indicative of imminent mass exploitation. The CVE is NOT in CISA KEV and there is no evidence of active exploitation. No SSVC decision data was provided in the input. The authentication requirement (PR:L) is the main mitigating factor and tempers the otherwise high CVSS; this is a real issue worth patching promptly on exposed Ruijie devices, but it is not a drop-everything zero-day. Note the vendor/firmware ambiguity: the CPE list pairs the X30-PRO with an 'rg-est310_firmware' entry, which should be confirmed against the actual affected model inventory.

An attacker who has obtained low-privilege authenticated access to a Ruijie X30-PRO's management interface sends a crafted POST request to the 'module_set' handler in /usr/local/lua/dev_sta/nbr_cwmp.lua, injecting shell metacharacters into a parameter that is passed unsanitized to an OS command. This yields arbitrary command execution on the device, enabling full compromise of the router. A public proof-of-concept is available, making reproduction straightforward for an authenticated attacker; low attack complexity (AC:L) means no special timing or race conditions are needed.