CVE-2025-56120
📋 TL;DR
This CVE describes an OS command injection vulnerability in Ruijie X60 PRO routers that allows attackers to execute arbitrary commands on the device. Attackers can exploit this by sending a crafted POST request to the vulnerable endpoint. Organizations using Ruijie X60 PRO routers with affected firmware versions are at risk.
💻 Affected Systems
- Ruijie X60 PRO
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to network infiltration, data exfiltration, and use as a pivot point for attacking internal networks.
Likely Case
Router compromise allowing traffic interception, credential theft, and deployment of persistent backdoors.
If Mitigated
Limited impact if network segmentation and proper access controls prevent exploitation attempts.
🎯 Exploit Status
Exploitation requires sending a crafted HTTP POST request to the vulnerable endpoint. Public proof-of-concept code is available in the GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Monitor Ruijie's security advisories for updates and apply patches when released.
🔧 Temporary Workarounds
Disable Web Management Interface
linuxDisable the web management interface if not required for operations
Check router documentation for disabling web interface commands
Network Access Control
linuxRestrict access to router management interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected routers from critical systems
- Deploy web application firewall (WAF) rules to block suspicious POST requests to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface or SSH. If version is V1.00 or V2.00, device is vulnerable.Check Version:
ssh admin@router_ip 'cat /etc/version' or check web interface System Information pageVerify Fix Applied:
Verify firmware has been updated to a version beyond V2.00 or check that the vulnerable endpoint no longer accepts malicious input.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /usr/local/lua/dev_config/config_retain.lua
- Suspicious command execution in system logs
- Multiple failed authentication attempts followed by successful POST
Network Indicators:
- HTTP POST requests containing shell metacharacters or command injection patterns
- Unusual outbound connections from router to external IPs
SIEM Query:
source="router_logs" AND (uri="/usr/local/lua/dev_config/config_retain.lua" OR method="POST" AND (body CONTAINS "|" OR body CONTAINS ";" OR body CONTAINS "`" OR body CONTAINS "$"))