CVE-2025-65363
📋 TL;DR
This vulnerability allows authenticated web users on Ruijie APs to execute arbitrary shell commands as root via command injection in the web_action.do endpoint. Attackers can disclose files, disrupt device operations, and potentially pivot to other network segments. Organizations using Ruijie APs with AP_RGOS 11.1.x are affected.
💻 Affected Systems
- Ruijie Access Points
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise leading to network-wide disruption, credential theft, lateral movement to other systems, and persistent backdoor installation.
Likely Case
Unauthorized file access, configuration modification, service disruption, and potential credential harvesting from the affected AP.
If Mitigated
Limited to authenticated users only, reducing exposure if strong authentication and access controls are implemented.
🎯 Exploit Status
Exploitation requires authenticated access to the web interface. Public proof-of-concept exists in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://ruijie.com
Restart Required: No
Instructions:
Check Ruijie official website for security advisories and firmware updates. Apply recommended patches when available.
🔧 Temporary Workarounds
Restrict Web Interface Access
linuxLimit access to the web management interface to trusted IP addresses only using firewall rules.
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable Web Management Interface
allTemporarily disable the web management interface if not required, using CLI management instead.
no service http-server
no service https-server
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Ruijie APs from critical network segments.
- Enforce strong authentication policies and monitor for unusual web interface access patterns.
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or CLI: show version | include AP_RGOSCheck Version:
show version | include AP_RGOSVerify Fix Applied:
Verify firmware version is updated beyond AP_RGOS 11.1.x and test command injection attempts fail.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to web_action.do with command parameters
- Multiple failed authentication attempts followed by successful login and web_action.do access
- System logs showing unexpected shell command execution
Network Indicators:
- HTTP/HTTPS traffic to AP web interface from unusual sources
- Patterns of command injection attempts in web requests
SIEM Query:
source="ap_logs" AND (url="*web_action.do*" AND (param="*command*" OR param="*;*" OR param="*|*" OR param="*`*"))