CVE-2025-56095
HighCVSS 8.8Exploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
OS Command Injection vulnerability in Ruijie RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00. Attackers can execute arbitrary commands via a crafted POST request to module_set in /usr/local/lua/dev_sta/nbr_cwmp.lua.
Risk Assessment
Remote code execution on the device, potentially allowing full control over the hardware.
Recommendation
Update device firmware and restrict access to the management interface.
Other vulnerabilities in Ruijie RG-EW1200G PRO
See all- CVE-2025-56123High
OS Command Injection vulnerability in Ruijie RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00. Attackers can execute arbitrary commands via a crafted POST request to module_get in /usr/local/lua/dev_sta/networkConnect.lua.
- CVE-2025-56090High
OS Command Injection vulnerability in Ruijie RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00. Attackers can execute arbitrary commands via a crafted POST request to module_set in /usr/local/lua/dev_config/config_retain.lua.
Original NVD description (English source)
OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS