Ruijie X60 PRO CVE-2025-56120

Exploitation requires authenticated access (CVSS PR:L) to the device's HTTP management interface and the ability to send a POST request to the 'module_set' operation handled by /usr/local/lua/dev_config/config_retain.lua on Ruijie X60 PRO firmware V1.00/V2.00 (build X60_10212014RG, CPE 1.021.2014; the RG-EW1200 firmware is also listed as affected per CPE). Limiting factors: the attacker must first obtain valid credentials or exploit weak/default logins, and must have network reachability to the management service - so exposure is sharply reduced where the admin interface is not reachable from untrusted networks. No user interaction is required (UI:N).

Signals are moderately but not uniformly elevated. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low-level authentication, yielding full C:H/I:H/A:H impact - consistent with OS command injection giving complete device takeover. EPSS is 2.64% (85th percentile): elevated relative to most CVEs but still a low absolute probability, indicating it is noticed but not yet broadly weaponized at scale. Publicly available exploit code exists (POC confirmed via GitHub and OneDrive references), which raises practical risk above the EPSS figure alone. This CVE is NOT on CISA KEV and no active exploitation is claimed, so this is 'exploit code exists' - distinct from in-the-wild use. The principal mitigating factor is PR:L: the attacker must already hold authenticated (even low-privilege) web/management access to the device, so this is primarily a privilege-escalation / post-authentication RCE rather than a pre-auth internet worm candidate. Net: a real, actionable priority for anyone exposing these Ruijie devices' management interface, but the authentication requirement and modest EPSS argue against treating it as an emergency on par with an unauthenticated KEV-listed flaw.

An attacker with valid low-privilege credentials (or a default/weak login) to the Ruijie X60 PRO management interface sends a crafted POST request to the module_set handler in /usr/local/lua/dev_config/config_retain.lua, injecting shell metacharacters that are passed to an OS command. Because the fix is a configuration-processing Lua endpoint executing commands as the device service account, this yields arbitrary command execution and full device compromise. Public exploit code for CVE-2025-56120 is available, lowering the skill barrier to reproduce the attack.