Ruijie RG-S1930 CVE-2025-56130

Exploitation targets the module_update function handled in /usr/local/lua/dev_config/ace_sw.lua and is triggered by a crafted POST request to that endpoint on the device management interface. The CVSS vector's PR:L means the attacker must hold at least a low-privilege authenticated account (or valid credentials) on the switch - this authentication requirement is the primary limiting factor, as the endpoint is not reachable fully unauthenticated. No user interaction is required (UI:N). Known-affected builds are RG-S1930 firmware 3.0(1)B11P230 and RG-NBS5100-24GT4SFP firmware 3.0(1)B11P248; exposure is further limited by whether the management plane is reachable by the attacker (segmented/management-VLAN-only deployments reduce the realistic attack surface).

This is a credible, actionable priority rather than a paper tiger. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates network-reachable exploitation at low attack complexity requiring only low-privilege authentication, with full confidentiality, integrity, and availability impact (C:H/I:H/A:H) on an unchanged scope - consistent with command injection yielding OS-level control of a network switch. Reinforcing signals: a public exploit/PoC exists (GitHub write-up by flegoity), and the EPSS score of 2.07% sits at the 81st percentile, which is elevated relative to the CVE population and signals above-average predicted exploitation interest, though not the near-certainty seen with mass-exploited bugs. The one tempering factor is the PR:L requirement - an attacker needs some authenticated foothold (e.g., a low-privilege device account or credentials), which limits fully anonymous internet-wide mass exploitation and points toward exploitation by insiders, credentialed attackers, or those chaining a prior auth bypass. The CVE is NOT on CISA KEV, so there is no confirmed active exploitation despite public exploit code; treat PoC availability and active in-the-wild exploitation as distinct. Net: high-impact, low-complexity, remotely reachable, with working exploit code - patch/mitigate promptly, but the authentication prerequisite makes it somewhat less wormable than a PR:N equivalent.

An attacker with low-privilege credentials (or who has otherwise reached the device management interface) sends a crafted POST request to the module_update handler in /usr/local/lua/dev_config/ace_sw.lua, injecting OS commands that the switch executes with device-level privileges. Publicly available exploit code (GitHub PoC) lowers the skill barrier, enabling full device takeover - traffic interception, configuration tampering, or using the switch as a network pivot.