CVE-2025-56113
📋 TL;DR
This CVE describes an OS command injection vulnerability in Ruijie RG-YST EST devices that allows attackers to execute arbitrary commands via a crafted POST request to the pwdmodify endpoint. Attackers can gain unauthorized system access and potentially compromise the entire device. Organizations using affected Ruijie RG-YST EST devices with vulnerable firmware versions are at risk.
💻 Affected Systems
- Ruijie RG-YST EST
📦 What is this software?
Reyee Os by Ruijie
Reyee Os by Ruijie
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to lateral movement within the network, data exfiltration, and persistent backdoor installation.
Likely Case
Unauthorized command execution leading to device configuration changes, service disruption, and potential credential theft.
If Mitigated
Limited impact with proper network segmentation and access controls preventing exploitation attempts.
🎯 Exploit Status
Exploitation requires sending a crafted POST request to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Check Ruijie official website for firmware updates and security advisories. Apply the latest firmware version when available.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict access to the device's web interface to trusted IP addresses only.
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable Web Interface
linuxTemporarily disable the web interface if not required for operations.
service httpd stop
systemctl disable httpd
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected devices from critical systems.
- Deploy web application firewall (WAF) rules to block command injection patterns targeting the vulnerable endpoint.
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or CLI. If version matches affected range, device is vulnerable.Check Version:
cat /etc/version or check via web interface system info pageVerify Fix Applied:
Verify firmware has been updated to a version beyond the affected range and test the vulnerable endpoint.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /usr/lib/lua/luci/modules/common.lua
- Suspicious command execution in system logs
- Multiple failed authentication attempts followed by successful access
Network Indicators:
- POST requests to pwdmodify endpoint with command injection patterns
- Outbound connections from device to unknown external IPs
SIEM Query:
source="device_logs" AND (uri="/usr/lib/lua/luci/modules/common.lua" OR method="POST" AND uri CONTAINS "pwdmodify")