CVE-2025-56099
📋 TL;DR
This CVE describes an OS command injection vulnerability in Ruijie RG-YST access points that allows attackers to execute arbitrary commands on the device. Attackers can exploit this by sending a crafted POST request to the pwdmodify endpoint. Organizations using Ruijie RG-YST AP_3.0(1)B11P280YST250F access points are affected.
💻 Affected Systems
- Ruijie RG-YST Access Point
📦 What is this software?
Reyee Os by Ruijie
Reyee Os by Ruijie
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to gain root access, install persistent backdoors, pivot to internal networks, and exfiltrate sensitive data.
Likely Case
Unauthorized command execution leading to device takeover, network disruption, and potential lateral movement within the network.
If Mitigated
Limited impact with proper network segmentation and access controls preventing exploitation attempts.
🎯 Exploit Status
The vulnerability requires no authentication and has publicly available proof-of-concept code, making exploitation trivial for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Check Ruijie official website for firmware updates. If available, download and apply the latest firmware patch following vendor instructions.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to the web interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable Web Interface
linuxDisable the vulnerable web interface if not required
service httpd stop
chkconfig httpd off
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected devices from critical networks
- Deploy web application firewall (WAF) rules to block malicious POST requests to pwdmodify endpoint
🔍 How to Verify
Check if Vulnerable:
Check if the device responds to POST requests at /usr/lib/lua/luci/modules/common.lua pwdmodify endpoint with command injection payloadsCheck Version:
ssh admin@device_ip 'cat /etc/version' or check web interface system info pageVerify Fix Applied:
Test if command injection payloads no longer execute when sent to the vulnerable endpoint📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to pwdmodify endpoint
- Command execution patterns in system logs
- Failed authentication attempts followed by POST requests
Network Indicators:
- POST requests containing shell metacharacters (;, |, &, $)
- Unusual outbound connections from access points
- Traffic to pwdmodify endpoint from unexpected sources
SIEM Query:
source="ap_logs" AND (uri="/usr/lib/lua/luci/modules/common.lua" OR uri="*pwdmodify*") AND (method="POST") AND (payload="*;*" OR payload="*|*" OR payload="*&*" OR payload="*$*")