Ruijie X60 PRO CVE-2025-56118

Exploitation requires network access to the device's management interface and a low-privilege authenticated session (CVSS PR:L), after which a single crafted POST request to the module_set function in /usr/local/lua/dev_sta/nbr_cwmp.lua injects OS commands - no user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must first reach the management interface (typically LAN-side or an exposed/forwarded admin port) and must hold at least low-level credentials; the flaw is specific to Ruijie X60 PRO firmware (V1.00/V2.00, CPE 1.021.2014) and, per CPE, RG-EW3200GX firmware 3.0(1)b11p219, so unaffected models/versions and devices not exposing the management interface to the attacker are not reachable. Default or weak router credentials would materially reduce the authentication barrier in practice.

CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-reachable, low-complexity command injection that requires low-privilege authentication (PR:L) but no user interaction, yielding full confidentiality, integrity, and availability impact - consistent with arbitrary OS command execution on an embedded router. Publicly available exploit code exists (GitHub advisory plus two hosted PoC files), which raises practical risk above a theoretical High. The EPSS score of 2.57% sits at the 85th percentile - elevated relative to the overall CVE population but not indicative of mass automated exploitation, suggesting opportunistic or targeted use rather than widespread campaigns at this time. There is no CISA KEV listing, so there is no confirmed active exploitation; the combination of available PoC + moderate-high EPSS percentile + low-privilege (not unauthenticated) prerequisite points to a credible but conditional threat. No SSVC decision data was provided in the input, so exploitation-status/automatable/technical-impact framing could not be cross-referenced. Key caveat: the CVSS vector specifies PR:L (authentication required), yet the description does not state what credential or access level enables the POST request - defenders should verify whether default/weak router credentials effectively lower this barrier.

An attacker with low-privilege access to the device's web/management interface (e.g., a valid or default user session) sends a crafted POST request to the module_set handler in /usr/local/lua/dev_sta/nbr_cwmp.lua, injecting shell metacharacters that are passed unsanitized to an OS command. The injected commands execute with the router's service privileges, enabling full device takeover. Publicly available PoC material lowers the skill barrier, and the low attack complexity (AC:L) means the request is reliable once the authentication prerequisite is met.