Ruijie RG-BCR860
CVE-2025-56129
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web UI
-
DeliverySend crafted POST to action_diagnosis
-
ExploitInject shell metacharacters into diagnosis parameter
-
ExecutionExecute arbitrary OS commands on device
-
ImpactFull compromise of router
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the RG-BCR860 web management interface and authenticated access at a low privilege level (CVSS PR:L), after which a crafted POST request to the action_diagnosis action in /usr/lib/lua/luci/controller/admin/diagnosis.lua injects commands into an underlying OS call. Limiting factors: valid credentials (or default/weak credentials) are needed, the LuCI-based admin interface must be exposed to the attacker's network path, and only firmware version 2.5.13 is confirmed affected per the CPE. No user interaction is required once authenticated. |
| Impact | This is a credible operational priority rather than a paper-high CVSS. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity, no-interaction attack requiring only low-level privileges, yielding full C:H/I:H/A:H impact via arbitrary OS command execution - consistent with CWE-78. Reinforcing signals: publicly available exploit code exists (confirmed via the referenced GitHub write-up), and EPSS is 2.64% at the 85th percentile, which is elevated for a networking-appliance CVE though not indicative of mass automated exploitation. The vulnerability is NOT in CISA KEV and there is no evidence of active exploitation. Note the one tension: CVSS marks PR:L (authentication required), so despite the network vector this is not fully unauthenticated - an attacker needs valid, even if low-privileged, access to the device's web management interface, which materially limits the exploitable population to networks where that interface is reachable and credentials (or default/weak credentials) are obtainable. No SSVC decision data was provided in the input. |
| Exploit ScenarioDerived | An attacker with low-privileged access to the RG-BCR860 web management interface sends a crafted POST request to the action_diagnosis handler, injecting shell metacharacters into a diagnostic parameter that is passed unsanitized to an OS command. The injected commands execute with the privileges of the web backend, giving the attacker command execution on the router. Public exploit/PoC code for this exact endpoint is available, lowering the barrier to weaponization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
OS command injection in the Ruijie RG-BCR860 wireless router (firmware 2.5.13) lets an authenticated attacker execute arbitrary commands on the underlying operating system by sending a crafted POST request to the action_diagnosis endpoint of the LuCI web management interface. Because the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N, exploitation requires only network reachability to the admin interface and low-privileged credentials - meaning default or weak administrator passwords, or any compromised low-privilege account, materially elevate risk - and needs no user interaction. Publicly available exploit code exists (a public write-up and PoC are linked from the references), and EPSS places the 30-day exploitation probability at 2.64% (85th percentile), which is high relative to the broader CVE population, although there is no confirmed active exploitation (CISA KEV) at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must begin with compensating controls while Ruijie is engaged for a fixed firmware release. First, immediately remove the RG-BCR860 web management interface from any untrusted or WAN-facing network path; if the device must be managed remotely, front it with a VPN or an IP-allowlisted management jump host - the trade-off is loss of direct remote convenience, but it eliminates the network reachability the assessment (AV:N) requires. Second, rotate all administrative credentials and eliminate default or weak passwords, since exploitation depends only on low-privileged access (PR:L); this applies equally to any delegated low-privilege accounts, which should be disabled entirely if they are not operationally required. Third, alert on and where possible block POST requests targeting the action_diagnosis action in the admin interface at any inline web proxy or IDS/IPS - this does not fix the flaw and can be evaded by encoding, but it raises the cost of the published exploit. Monitor the GitHub advisory at https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56129.md and the NVD record for a patched firmware version, and plan a maintenance window to apply it as soon as it is published; until then, treat any RG-BCR860 on 2.5.13 that has a reachable management interface as potentially compromised and review its logs for unexpected command execution or outbound connections.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-78 OS command injection in the LuCI web administration framework used by Ruijie's RG-BCR860 firmware. LuCI is a Lua-based MVC web front end (originally from OpenWrt); the affected controller, /usr/lib/lua/luci/controller/admin/diagnosis.lua, exposes the action_diagnosis HTTP action, which drives the device's built-in diagnostic utilities (ping/traceroute-style functions). Rather than validating the user-supplied diagnostic parameters before passing them to an operating system shell invocation, the code allows shell metacharacters to reach the underlying OS call, so an attacker who can post to that action can append or inject arbitrary commands executed with the privileges of the web service (typically root on embedded router firmware). The CPE cpe:2.3:o:ruijie:rg-bcr860_firmware:2.5.13 confirms firmware 2.5.13 as the identified affected release. Successful exploitation yields full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) on the device, which as a network edge/branch router is a high-value pivot point for lateral movement into the protected network.
Know when Rg Bcr860 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable LuCI endpoint with low-complexity injection; PR:L because a low-privilege authenticated session is required, and command execution yields full C/I/A impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to the action_diagnosis in file /usr/lib/lua/luci/controller/admin/diagnosis.lua.
Executive ViewAI
Ruijie RG-BCR860 wireless routers on firmware 2.5.13 carry a high-severity flaw that can give an authenticated low-privileged attacker control of the device. Publicly available exploit code exists, and no vendor-released patch has been identified, so affected deployments should be treated as urgent containment priorities. Leadership should care because these devices may serve as entry points into branch, retail, or remote networks, risking data exposure, service disruption, and lateral movement if credentials are weak or management interfaces are reachable.
No vendor-released patch identified at time of analysis; restrict management interface access to trusted networks or VPN, disable internet-facing administration, enforce strong unique credentials and least privilege, segment affected devices, monitor for POST requests to action_diagnosis, and contact vendor for fixed firmware.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)CVE.org
More in Rg Bcr860 Firmware
View allOS command injection in Ruijie RG-BCR860 firmware lets an authenticated remote attacker execute arbitrary commands on th
OS command injection in the Ruijie RG-BCR860 router firmware (build 2.5.13-r2224) lets attackers with a valid low-privil
Authenticated attackers with low-privilege access can execute arbitrary OS commands on Ruijie RG-BCR860 routers by sendi
OS command injection in Ruijie RG-BCR860 firmware allows authenticated attackers with network access to the LuCI web man
A vulnerability was found in Ruijie RG-BCR860 2.5.13 and classified as critical. Rated high severity (CVSS 7.2), this vu
Exploit-DB