CVE-2025-56092
HighCVSS 8.8Exploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
OS Command Injection vulnerability in Ruijie X30 PRO V1 (X30-PRO-V1_09241521). Attackers can execute arbitrary commands via a crafted POST request to module_get in /usr/local/lua/dev_sta/networkConnect.lua.
Risk Assessment
Remote command execution on the device, potentially leading to network compromise.
Recommendation
Apply available updates and secure the device against unauthorized access.
Other vulnerabilities in Ruijie X30 PRO
See all- CVE-2025-56117High
OS Command Injection vulnerability in Ruijie X30-PRO (version X30-PRO-V1_09241521). An attacker can execute arbitrary commands via a crafted POST request to the module_set function in file /usr/local/lua/dev_sta/nbr_cwmp.lua.
- CVE-2025-56108High
An OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allows attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua.
- CVE-2025-56098High
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
- CVE-2025-56094High
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/host_access_delay.lua.
- CVE-2025-56093High
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the setWisp in file /usr/lib/lua/luci/modules/wireless.lua.
Original NVD description (English source)
OS Command Injection vulnerability in Ruijie X30 PRO V1 X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS