CVE-2025-56123
📋 TL;DR
This CVE describes an OS command injection vulnerability in Ruijie RG-EW1200G PRO wireless access points. Attackers can execute arbitrary commands on the device by sending a specially crafted POST request to the vulnerable endpoint. Organizations using affected Ruijie access points are at risk.
💻 Affected Systems
- Ruijie RG-EW1200G PRO
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing persistent backdoor installation, network pivoting to internal systems, and data exfiltration.
Likely Case
Unauthorized network access, device configuration changes, and potential lateral movement within the network.
If Mitigated
Limited impact if network segmentation and proper access controls prevent exploitation attempts.
🎯 Exploit Status
Exploitation requires sending a crafted POST request to /usr/local/lua/dev_sta/networkConnect.lua endpoint. Public proof-of-concept exists in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Check Ruijie official website for security advisories and firmware updates. No official patch information available at this time.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to the management interface using firewall rules
Endpoint Isolation
allSegment affected devices to prevent lateral movement
🧯 If You Can't Patch
- Isolate affected devices from critical network segments
- Implement strict network monitoring for suspicious POST requests to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or CLI. Versions V1.00-V4.00 are vulnerable.Check Version:
Check via web interface at System Status > Firmware Version or via CLI with 'show version'Verify Fix Applied:
Monitor for firmware updates from Ruijie and apply when available. Verify version is above V4.00.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /usr/local/lua/dev_sta/networkConnect.lua
- Suspicious command execution in system logs
Network Indicators:
- POST requests containing shell metacharacters or command injection patterns to the vulnerable endpoint
SIEM Query:
source="network_device" AND (uri="/usr/local/lua/dev_sta/networkConnect.lua" AND method="POST" AND (content CONTAINS "|" OR content CONTAINS ";" OR content CONTAINS "`" OR content CONTAINS "$"))