CVE-2025-56129
📋 TL;DR
This CVE describes an OS command injection vulnerability in Ruijie RG-BCR860 routers that allows attackers to execute arbitrary commands via crafted POST requests to the diagnosis controller. Attackers can gain remote code execution on affected devices, potentially compromising the entire network. Organizations using Ruijie RG-BCR860 routers are affected.
💻 Affected Systems
- Ruijie RG-BCR860
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to network compromise, data exfiltration, lateral movement to other systems, and persistent backdoor installation.
Likely Case
Unauthorized command execution allowing network reconnaissance, credential harvesting, and potential pivot to internal systems.
If Mitigated
Limited impact due to network segmentation, proper access controls, and monitoring preventing successful exploitation.
🎯 Exploit Status
Exploitation requires authentication to the web interface. The vulnerability is in a controller that processes user input without proper sanitization.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available at time of analysis
Restart Required: Yes
Instructions:
1. Contact Ruijie support for firmware updates. 2. Download latest firmware from vendor portal. 3. Backup configuration. 4. Upload and apply firmware update. 5. Verify fix and restore configuration if needed.
🔧 Temporary Workarounds
Disable Web Management Interface
linuxDisable the web management interface if not required for operations
# Access device via SSH/Telnet
# Disable web interface service
# Specific commands depend on firmware version
Network Access Control
linuxRestrict access to management interface using firewall rules
# Example iptables rule to restrict access
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Ruijie devices from critical systems
- Deploy web application firewall (WAF) rules to block suspicious POST requests to /usr/lib/lua/luci/controller/admin/diagnosis.lua
🔍 How to Verify
Check if Vulnerable:
Check if device responds to POST requests at the vulnerable endpoint and test with safe command injection payloads (like 'id' command).Check Version:
Check web interface login page or use SSH command: cat /etc/version or similar firmware version fileVerify Fix Applied:
Test the same endpoint with command injection payloads after patching - should return error or sanitized output.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /usr/lib/lua/luci/controller/admin/diagnosis.lua
- Commands with shell metacharacters in web logs
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- Unusual outbound connections from Ruijie device
- POST requests containing shell commands or special characters
SIEM Query:
source="ruijie_web_logs" AND (uri="/usr/lib/lua/luci/controller/admin/diagnosis.lua" AND method="POST") AND (request_body CONTAINS "|" OR request_body CONTAINS ";" OR request_body CONTAINS "`" OR request_body CONTAINS "$")