CVE-2025-56090
HighCVSS 8.8Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
OS Command Injection vulnerability in Ruijie RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00. Attackers can execute arbitrary commands via a crafted POST request to module_set in /usr/local/lua/dev_config/config_retain.lua.
Risk Assessment
Risk of device takeover and arbitrary command execution, potentially compromising network integrity.
Recommendation
Apply available firmware updates from the vendor and restrict access to the administrative interface.
Other vulnerabilities in Ruijie RG-EW1200G PRO
See all- CVE-2025-56123High
OS Command Injection vulnerability in Ruijie RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00. Attackers can execute arbitrary commands via a crafted POST request to module_get in /usr/local/lua/dev_sta/networkConnect.lua.
- CVE-2025-56095High
OS Command Injection vulnerability in Ruijie RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00. Attackers can execute arbitrary commands via a crafted POST request to module_set in /usr/local/lua/dev_sta/nbr_cwmp.lua.
Original NVD description (English source)
OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS