CVE-2025-56124
📋 TL;DR
This CVE describes an OS command injection vulnerability in Ruijie X60 PRO routers that allows attackers to execute arbitrary commands on the device. Attackers can exploit it by sending a crafted POST request to a specific Lua endpoint. Organizations using Ruijie X60 PRO routers with vulnerable firmware versions are affected.
💻 Affected Systems
- Ruijie X60 PRO
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing installation of persistent backdoors, credential theft, network pivoting to internal systems, and disruption of network services.
Likely Case
Unauthorized command execution leading to device configuration changes, network reconnaissance, and potential lateral movement within the network.
If Mitigated
Limited impact with proper network segmentation, command execution restricted to low-privilege contexts, and monitoring detecting exploitation attempts.
🎯 Exploit Status
Exploitation requires network access to the device's web interface but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Check Ruijie official website for firmware updates. If available, download latest firmware and follow vendor upgrade procedures.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict access to the device's management interface to trusted IP addresses only
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable Vulnerable Endpoint
linuxRemove or disable access to the vulnerable Lua endpoint if possible
rm /usr/local/lua/dev_sta/networkConnect.lua
chmod 000 /usr/local/lua/dev_sta/networkConnect.lua
🧯 If You Can't Patch
- Isolate affected devices in a separate VLAN with strict firewall rules
- Implement network monitoring for POST requests to /usr/local/lua/dev_sta/networkConnect.lua
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or SSH: cat /etc/version | grep X60_10212014RGCheck Version:
cat /etc/versionVerify Fix Applied:
Verify firmware version is updated beyond V2.00 and test POST requests to the vulnerable endpoint return errors📡 Detection & Monitoring
Log Indicators:
- POST requests to /usr/local/lua/dev_sta/networkConnect.lua with suspicious parameters
- Unusual command execution in system logs
- Failed authentication attempts followed by successful POST requests
Network Indicators:
- HTTP POST requests to router IP on port 80/443 containing command injection patterns (;, |, &, $, etc.)
- Unusual outbound connections from router to external IPs
SIEM Query:
source="router_logs" AND (uri="/usr/local/lua/dev_sta/networkConnect.lua" OR (method="POST" AND (param CONTAINS ";" OR param CONTAINS "|" OR param CONTAINS "&" OR param CONTAINS "$")))