Ruijie RG-BCR600W CVE-2025-56127

Exploitation requires network reachability to the RG-BCR600W web management interface AND valid low-privilege authentication (CVSS PR:L) - an unauthenticated anonymous attacker cannot directly trigger it per the supplied vector. The specific trigger is a crafted POST request to the get_wanobj function implemented in /usr/lib/lua/luci/controller/admin/common.lua, where attacker-controlled WAN-object input is concatenated into an OS command without sanitization. Limiting factors: the attacker must first obtain credentials or hijack a session, and exposure depends on whether the management interface is reachable from the attacker's network position (LAN by default; far higher risk if WAN/remote management is enabled). Affected build is firmware 1.0.4.4468; no user interaction is required once authenticated.

Signals are moderately consistent and point to a real but conditional threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity OS command injection requiring only low-privilege authentication, with full C/I/A impact (8.8 High) - consistent with command execution on an embedded router controller written in Lua. A public exploit/PoC exists (GitHub write-up by flegoity), which materially lowers the bar for attackers. EPSS is 3.14% (88th percentile): elevated relative to the average CVE but still an absolute low probability, indicating interest but not yet broad automated exploitation. The vulnerability is NOT listed in CISA KEV, so there is no confirmation of active in-the-wild exploitation. No SSVC decision data was provided. Net assessment: this is a legitimate priority for anyone operating RG-BCR600W devices - authenticated RCE with public exploit code - but the PR:L requirement (an attacker needs valid, even low-level, credentials or a session) and the apparent low real-world footprint of this specific router model temper the systemic risk. The key tension to flag: PoC availability and a high CVSS do not equal active exploitation, and the modest EPSS plus absence from KEV suggest opportunistic/targeted rather than widespread exploitation at this time.

An attacker who has obtained low-privilege web credentials (or an authenticated session) to an internet- or LAN-exposed RG-BCR600W sends a crafted POST request to the get_wanobj handler in common.lua, injecting shell metacharacters into a parameter that is passed unsanitized to an OS command. The injected command executes with the privileges of the router's web/management process (typically root on such embedded devices), yielding full device takeover. A public PoC/write-up for this exact endpoint is available, so weaponization effort is minimal.