Ruijie RG-EW1200G PRO CVE-2025-56123

Exploitation requires network reachability to the device's web management interface and the ability to issue an authenticated (low-privilege, per CVSS PR:L) POST request to the module_get function in /usr/local/lua/dev_sta/networkConnect.lua; the request must carry shell metacharacters in a parameter that is passed unsanitized to an OS command. Limiting factors: the attacker needs at least low-privilege access/credentials to the router UI (not fully unauthenticated), and the management interface must be reachable from the attacker's position - devices whose admin interface is not WAN-exposed and that use strong, non-default credentials substantially reduce exposure. Affected scope is specifically Ruijie RG-EW1200G PRO firmware V1.00/V2.00/V3.00/V4.00 (and the related RG-EW1300G per CPE); no user interaction is required (UI:N).

This is a genuine, elevated-priority issue but not a top-tier internet-wide emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication, yielding full compromise (C:H/I:H/A:H) consistent with OS command injection (CWE-78) that grants code execution on the device. Supporting signals align: publicly available exploit code exists (GitHub PoC by flegoity), and the EPSS score of 2.64% sits in the 85th percentile - moderately elevated above baseline, reflecting the public PoC, but far from the high-probability tier. Critically, this CVE is NOT on the CISA KEV list, so there is no confirmed active exploitation despite PoC availability - do not conflate the two. The main mitigating factor is PR:L: an attacker needs at least low-privilege credentials or an authenticated session to the router interface, which bounds mass unauthenticated exploitation. The prevalence of the affected product (Ruijie consumer/SMB WiFi router) is modest outside its core Asian markets, further limiting blast radius. Net: prioritize patching for anyone operating Ruijie RG-EW1200G PRO / RG-EW1300G devices, especially where the management interface is network-exposed, but this is a targeted-device risk rather than a ubiquitous-platform crisis.

An attacker with low-privilege access to the router's web interface (or valid/weak credentials) sends a crafted POST request to the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua, injecting shell metacharacters that are passed unsanitized to an OS command. This results in arbitrary command execution on the device with the privileges of the web service. A public proof-of-concept exists on GitHub, lowering the skill barrier; the low attack complexity (AC:L) means exploitation is reliable once the authenticated endpoint is reachable.