CVE-2025-56124
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk70th percentile - higher than 70% of all known CVEs
Summary
An OS Command Injection vulnerability in the Ruijie X60 PRO (V1.00/V2.00) allows attackers to execute arbitrary commands via a crafted POST request to the module_get in the file /usr/local/lua/dev_sta/networkConnect.lua.
Risk Assessment
An attacker with network access to the device interface can take control of the system and execute arbitrary commands with elevated privileges, leading to full device compromise.
Recommendation
Update the Ruijie X60 PRO firmware to a version containing the fix as soon as possible and restrict access to the management interface to trusted networks only.
Other vulnerabilities in Ruijie X60 PRO
See all- CVE-2025-56120High
An OS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allows attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.
- CVE-2025-56118High
An OS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allows attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.
Original NVD description (English source)
OS Command Injection vulnerability in Ruijie X60 PRO X60_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS