Ruijie RG-EW1800GX PRO CVE-2025-56122

Exploitation requires authenticated access (PR:L) to the device's web management interface and the ability to reach the module_get endpoint backed by /usr/local/lua/dev_sta/networkConnect.lua; the attacker submits a crafted POST request whose parameter is passed unsanitized into an OS command (CWE-78). No user interaction is needed. Key limiting factors: valid low-privilege credentials (or a hijacked session) are required, and on these consumer/SOHO routers the management interface is typically LAN-only - so remote (WAN) exploitation generally depends on remote administration being explicitly enabled or the panel being internet-exposed. Risk is highest where default/weak credentials are in use or remote management is turned on.

Signals are largely consistent and point to a genuine but conditionally-gated risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a low-complexity, network-reachable command injection requiring only low privileges and no user interaction, yielding full confidentiality/integrity/availability impact - consistent with CWE-78 arbitrary command execution on an embedded router. Exploitation status is 'publicly available exploit code exists' (POC=YES) but this is NOT confirmed active exploitation: the CVE is not in CISA KEV, so POC availability and in-the-wild use must not be conflated. EPSS of 2.64% (85th percentile) is moderate - elevated above background but far from the high-probability tier, suggesting interest but no evidence of mass automated exploitation yet. The PR:L requirement is the single largest risk-dampener: an attacker needs authenticated access to the router's management interface, which on consumer/SOHO routers is frequently LAN-restricted unless remote administration is enabled. Net: a real priority for exposed or remote-managed devices and for defense-in-depth, but not a drop-everything emergency for devices with management confined to the LAN and non-default credentials. Verify remote-management exposure before assigning emergency priority.

An attacker with low-privileged access to the router's web management interface (e.g., stolen/default credentials, or reaching an internet-exposed admin panel) sends a crafted POST request to the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua, injecting shell metacharacters into an unsanitized parameter. The injected commands execute with the device's privileges, giving full control of the router. Public exploit code is available, lowering the skill barrier to weaponize this.