Ruijie X60 PRO CVE-2025-56124

Exploitation requires the attacker to reach the device's web/management backend and submit a POST request to the module_get function in /usr/local/lua/dev_sta/networkConnect.lua; the injected shell commands run on the router OS. The input CVSS vector's PR:L indicates low-privilege authentication to the management interface is a prerequisite, which limits exploitation to actors who can both reach the interface and possess (or bypass to obtain) valid credentials. The practical blast radius also depends on whether the management interface is exposed only on the LAN or is remotely reachable - a key limiting factor not resolved by the available data. No user interaction is required (UI:N). Only the listed firmware builds (RG-X60 PRO V1.00/V2.00, firmware 1.021.2014; and RG-EW1200 firmware per CPE) are affected.

This is a CWE-78 OS command injection in Ruijie X60 PRO (and per CPE, RG-EW1200) router firmware. The signals are mixed. The input CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) scores 7.8 and models a LOCAL, authenticated attacker, yet the description explicitly says the flaw is triggered 'via a crafted POST request' to a Lua web endpoint - behavior consistent with a NETWORK vector (AV:N). This is a direct conflict: if the POST can be delivered over the LAN/management interface, real-world attack vector is network, not local, and effective severity is higher than 7.8 (closer to 8.8) - verify delivery path with the vendor. A public exploit write-up exists on GitHub (publicly available exploit code exists), which materially raises actionable risk. However, EPSS is only 1.30% (70th percentile), indicating low modeled probability of broad opportunistic exploitation in the near term, and the CVE is NOT on the CISA KEV list, so there is no confirmed active exploitation. No SSVC decision record was provided. Net: a genuine, POC-backed command-injection flaw with full C/I/A impact against the affected device, but current data points to a targeted/manual exploitation profile (router-specific, likely authentication-gated) rather than mass exploitation. Prioritize patching for any exposed/managed Ruijie X60 PRO or EW1200 fleet, but it is not a drop-everything internet-worm scenario on present evidence.

An attacker with access to the router's management interface (and, per the CVSS PR:L, low-level credentials) sends a crafted POST request to the module_get handler in /usr/local/lua/dev_sta/networkConnect.lua, injecting shell metacharacters into an unsanitized parameter. The commands execute with the privileges of the web backend, yielding arbitrary command execution on the device. A public proof-of-concept write-up exists on GitHub, lowering the skill needed to reproduce; CVSS AC:L indicates the attack is reliable once the request can be delivered.