CVE-2025-56118
📋 TL;DR
This CVE describes an OS command injection vulnerability in Ruijie X60 PRO routers that allows attackers to execute arbitrary commands on the device. Attackers can exploit this by sending a crafted POST request to the vulnerable module_set function. Organizations using Ruijie X60 PRO routers with affected firmware versions are at risk.
💻 Affected Systems
- Ruijie X60 PRO
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to pivot to internal networks, intercept/modify traffic, install persistent backdoors, or use the device for botnet activities.
Likely Case
Attackers gain shell access to the router, enabling them to modify configurations, intercept network traffic, or use the device as a foothold for further attacks.
If Mitigated
Limited impact if proper network segmentation and access controls prevent exploitation attempts from reaching the vulnerable interface.
🎯 Exploit Status
The vulnerability requires sending a crafted POST request to /usr/local/lua/dev_sta/nbr_cwmp.lua. Public references include exploit details and proof-of-concept information.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Check Ruijie's official website for security advisories and firmware updates. Consider workarounds or replacement if no fix is forthcoming.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict access to the router's management interface to trusted IP addresses only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disable Vulnerable Module
linuxDisable or restrict access to the nbr_cwmp.lua file if not required
chmod 000 /usr/local/lua/dev_sta/nbr_cwmp.lua
🧯 If You Can't Patch
- Segment affected routers in isolated network zones to limit lateral movement potential
- Implement strict egress filtering to prevent compromised routers from communicating with external command and control servers
🔍 How to Verify
Check if Vulnerable:
Check if the file /usr/local/lua/dev_sta/nbr_cwmp.lua exists and contains the vulnerable module_set function. Test with a controlled payload to see if command injection is possible.Check Version:
Check firmware version via web interface or CLI: cat /etc/version or similar vendor-specific commandVerify Fix Applied:
Verify that the vulnerable function has been patched or that the file is no longer accessible/executable. Test with the same payload to confirm it no longer executes commands.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /usr/local/lua/dev_sta/nbr_cwmp.lua
- Suspicious command execution in system logs
- Unexpected process creation from web server
Network Indicators:
- HTTP requests containing shell metacharacters or command injection patterns
- Outbound connections from router to unusual external IPs
SIEM Query:
source="router_logs" AND (uri="/usr/local/lua/dev_sta/nbr_cwmp.lua" OR cmd="*;*" OR cmd="*|*" OR cmd="*`*" OR cmd="*$(*)")