CVE-2025-56117
📋 TL;DR
This CVE describes an OS command injection vulnerability in Ruijie X30-PRO routers that allows attackers to execute arbitrary commands via a crafted POST request. Attackers can achieve remote code execution with high privileges, potentially compromising the entire device. Organizations using Ruijie X30-PRO routers with vulnerable firmware versions are affected.
💻 Affected Systems
- Ruijie X30-PRO
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, pivot to internal networks, intercept traffic, or use the device as part of a botnet.
Likely Case
Attackers gain shell access to the router, modify configurations, steal credentials, and potentially use the device as a foothold for lateral movement.
If Mitigated
Limited impact if network segmentation isolates the device and strict egress filtering prevents command and control communication.
🎯 Exploit Status
The GitHub repository contains detailed exploitation information. The vulnerability requires sending a crafted POST request to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Ruijie official website for firmware updates. 2. Download latest firmware for X30-PRO. 3. Upload firmware via web interface. 4. Apply update and reboot device.
🔧 Temporary Workarounds
Block access to vulnerable endpoint
linuxUse firewall rules to block access to /usr/local/lua/dev_sta/nbr_cwmp.lua endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "nbr_cwmp.lua" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "nbr_cwmp.lua" --algo bm -j DROP
Disable CWMP/TR-069 if not needed
allTurn off TR-069 remote management functionality
Connect to router web interface
Navigate to Management > TR-069
Disable TR-069 client
🧯 If You Can't Patch
- Segment Ruijie devices on isolated VLANs with strict firewall rules
- Implement network-based intrusion detection to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface: System > System Information > Firmware Version. If version is X30-PRO-V1_09241521 or earlier, device is likely vulnerable.Check Version:
curl -s http://router-ip/cgi-bin/luci/ | grep -i firmwareVerify Fix Applied:
After updating firmware, verify the version has changed from vulnerable version. Test with controlled exploitation attempt from authorized security testing system.📡 Detection & Monitoring
Log Indicators:
- POST requests to /usr/local/lua/dev_sta/nbr_cwmp.lua with shell metacharacters
- Unusual process execution from web server context
- Failed authentication attempts followed by POST to vulnerable endpoint
Network Indicators:
- HTTP POST requests containing shell commands (;, |, &, $, etc.) to router management interface
- Outbound connections from router to unknown IPs post-exploitation
SIEM Query:
source="router_logs" AND (uri="*nbr_cwmp.lua*" AND method="POST" AND (content="*;*" OR content="*|*" OR content="*`*" OR content="*$(*"))