Rg X60 Pro Firmware
Monthly
Authenticated command execution in Ruijie X60 PRO router firmware (RG-X60 PRO V1.00/V2.00, build 1.021.2014, with RG-EW1200 firmware also listed via CPE) allows an attacker who can reach the device's web/m anagement backend to run arbitrary OS commands on the router by submitting a crafted POST request to the module_get routine in /usr/local/lua/dev_sta/networkConnect.lua. The flaw is a CWE-78 OS command injection; the assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates low-privilege credentials on the management interface are required, but no user interaction is needed and successful exploitation yields full compromise of confidentiality, integrity, and availability on the device. Publicly available exploit code exists (a detailed GitHub write-up for CVE-2025-56124), and EPSS sits at 1.30% (70th percentile), so exploitation is plausible for attackers with management-plane access even though no confirmed in-the-wild activity is reported. No vendor-released patch was identified at time of analysis.
OS command injection in Ruijie X60 PRO firmware (V1.00/V2.00, build X60_10212014RG) lets an authenticated remote attacker who can reach the device's HTTP management interface execute arbitrary operating-system commands by sending a crafted POST request to the module_set operation handled by /usr/local/lua/dev_config/config_retain.lua. The vulnerability requires valid credentials (CVSS PR:L, network reachable, no user interaction), so practical exposure is concentrated on devices whose admin interface is exposed to untrusted networks or left on weak/default logins. Publicly available exploit code exists and EPSS sits at roughly 2.64% (85th percentile), indicating moderately elevated but not uniformly high exploitation risk; no CISA KEV confirmation of active exploitation was present in the available data.
Authenticated OS command injection in Ruijie X60 PRO router firmware (V1.00/V2.00, build 1.021.2014) allows an attacker holding low-privilege credentials to run arbitrary system commands via a crafted POST request to the module_set function in /usr/local/lua/dev_sta/nbr_cwmp.lua, yielding full compromise of confidentiality, integrity, and availability (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The same flaw is reported against Ruijie RG-EW3200GX firmware 3.0(1)b11p219. Publicly available exploit code exists (including a GitHub write-up and hosted PoC artifacts), and EPSS places the CVE at roughly 2.57% (85th percentile), so it is a realistically attractive target for exploitation once an attacker can reach the management interface, though it requires at least low-level authentication and is not confirmed as actively exploited (no CISA KEV listing).
Authenticated command execution in Ruijie X60 PRO router firmware (RG-X60 PRO V1.00/V2.00, build 1.021.2014, with RG-EW1200 firmware also listed via CPE) allows an attacker who can reach the device's web/m anagement backend to run arbitrary OS commands on the router by submitting a crafted POST request to the module_get routine in /usr/local/lua/dev_sta/networkConnect.lua. The flaw is a CWE-78 OS command injection; the assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates low-privilege credentials on the management interface are required, but no user interaction is needed and successful exploitation yields full compromise of confidentiality, integrity, and availability on the device. Publicly available exploit code exists (a detailed GitHub write-up for CVE-2025-56124), and EPSS sits at 1.30% (70th percentile), so exploitation is plausible for attackers with management-plane access even though no confirmed in-the-wild activity is reported. No vendor-released patch was identified at time of analysis.
OS command injection in Ruijie X60 PRO firmware (V1.00/V2.00, build X60_10212014RG) lets an authenticated remote attacker who can reach the device's HTTP management interface execute arbitrary operating-system commands by sending a crafted POST request to the module_set operation handled by /usr/local/lua/dev_config/config_retain.lua. The vulnerability requires valid credentials (CVSS PR:L, network reachable, no user interaction), so practical exposure is concentrated on devices whose admin interface is exposed to untrusted networks or left on weak/default logins. Publicly available exploit code exists and EPSS sits at roughly 2.64% (85th percentile), indicating moderately elevated but not uniformly high exploitation risk; no CISA KEV confirmation of active exploitation was present in the available data.
Authenticated OS command injection in Ruijie X60 PRO router firmware (V1.00/V2.00, build 1.021.2014) allows an attacker holding low-privilege credentials to run arbitrary system commands via a crafted POST request to the module_set function in /usr/local/lua/dev_sta/nbr_cwmp.lua, yielding full compromise of confidentiality, integrity, and availability (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The same flaw is reported against Ruijie RG-EW3200GX firmware 3.0(1)b11p219. Publicly available exploit code exists (including a GitHub write-up and hosted PoC artifacts), and EPSS places the CVE at roughly 2.57% (85th percentile), so it is a realistically attractive target for exploitation once an attacker can reach the management interface, though it requires at least low-level authentication and is not confirmed as actively exploited (no CISA KEV listing).