CVE-2025-56114
📋 TL;DR
This CVE describes an OS command injection vulnerability in Ruijie M18 routers that allows attackers to execute arbitrary commands on the device via a crafted POST request. The vulnerability affects Ruijie M18 routers running specific firmware versions and can be exploited without authentication. Network administrators using these devices are at risk of complete system compromise.
💻 Affected Systems
- Ruijie M18 Router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover allowing attackers to install persistent backdoors, pivot to internal networks, exfiltrate sensitive data, or use the device as part of a botnet.
Likely Case
Attackers gain root access to the router, enabling them to intercept network traffic, modify configurations, and potentially compromise connected devices.
If Mitigated
If proper network segmentation and access controls are in place, impact may be limited to the router itself without lateral movement to other systems.
🎯 Exploit Status
Exploitation requires sending a crafted POST request to the vulnerable endpoint. Public proof-of-concept code is available in GitHub repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch is currently available. Monitor Ruijie's security advisories for updates and apply patches immediately when released.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict access to the router's management interface to trusted IP addresses only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disable Remote Management
allDisable remote management features if not required
Check router web interface for remote management settings and disable
🧯 If You Can't Patch
- Isolate affected routers in a separate VLAN with strict firewall rules
- Implement network monitoring and intrusion detection for suspicious POST requests to /usr/local/lua/dev_config/config_retain.lua
🔍 How to Verify
Check if Vulnerable:
Check if the router is running EW_3.0(1)B11P226_M18_10223116 firmware version. The vulnerability can be tested by sending a crafted POST request to the module_set parameter in /usr/local/lua/dev_config/config_retain.lua (Note: testing may trigger exploitation).Check Version:
Check router web interface or use SNMP queries to determine firmware versionVerify Fix Applied:
Verify firmware has been updated to a version newer than EW_3.0(1)B11P226_M18_10223116. Test that command injection attempts no longer succeed.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /usr/local/lua/dev_config/config_retain.lua
- Commands with shell metacharacters in POST parameters
- Unexpected system command execution in router logs
Network Indicators:
- POST requests containing shell commands (;, |, &, $, etc.) in parameters
- Unusual outbound connections from the router
- Traffic to suspicious IP addresses from router
SIEM Query:
source="router_logs" AND (uri="/usr/local/lua/dev_config/config_retain.lua" AND method="POST" AND (param CONTAINS ";" OR param CONTAINS "|" OR param CONTAINS "$" OR param CONTAINS "`"))