CVE-2025-56111
📋 TL;DR
This CVE describes an OS command injection vulnerability in Ruijie RG-BCR860 routers that allows attackers to execute arbitrary commands on the device. Attackers can exploit this by sending a crafted POST request to the network_set_wan_conf endpoint. Organizations using Ruijie RG-BCR860 routers are affected.
💻 Affected Systems
- Ruijie RG-BCR860
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, pivot to internal networks, intercept traffic, or use the device as part of a botnet.
Likely Case
Attackers gain shell access to the router, enabling them to modify configurations, intercept network traffic, or use the device for further attacks.
If Mitigated
Limited impact due to network segmentation, proper access controls, and monitoring that detects exploitation attempts.
🎯 Exploit Status
Exploitation requires access to the web management interface but no authentication. Public proof-of-concept code is available in GitHub repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Ruijie official website for security advisories. 2. Download latest firmware if available. 3. Backup current configuration. 4. Upload and install new firmware via web interface. 5. Restart device. 6. Restore configuration if needed.
🔧 Temporary Workarounds
Disable web management interface
linuxDisable the web-based management interface to prevent exploitation
# Via SSH/Telnet: disable web interface
# Configuration depends on specific firmware
Network access restrictions
linuxRestrict access to management interface using firewall rules
# Example iptables rule: iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Isolate affected routers in separate VLAN with strict firewall rules
- Implement network monitoring for suspicious POST requests to /usr/lib/lua/luci/controller/admin/netport.lua
🔍 How to Verify
Check if Vulnerable:
Check if device responds to POST requests at the vulnerable endpoint and test with safe command injection payloads like '; echo test'Check Version:
# Check firmware version via web interface or SSH: cat /etc/versionVerify Fix Applied:
Test the same endpoint with command injection payloads after applying fixes - should return error or no command execution📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to network_set_wan_conf endpoint
- Commands with shell metacharacters in web logs
- Unexpected processes spawned from web server
Network Indicators:
- POST requests containing shell metacharacters (;, |, &, $)
- Unusual outbound connections from router
SIEM Query:
source="web_logs" AND uri="/usr/lib/lua/luci/controller/admin/netport.lua" AND (method="POST" AND (body="*;*" OR body="*|*" OR body="*&*" OR body="*$(*"))