PT-2025-50665 · Ruijie · Rg-Ew1200G Pro

Published 2025-12-11 · Updated 2025-12-14 · CVE-2025-56095

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ruijie RG-EW1200G PRO versions 1.00 through 4.00

Description An issue exists in Ruijie RG-EW1200G PRO that allows attackers to execute arbitrary commands. This is due to an OS Command Injection flaw within the nbr cwmp.lua file located at /usr/local/lua/dev sta/. Specifically, a crafted POST request to the module set function can be used to inject and execute commands. The module set function is vulnerable to this injection.

Recommendations Versions 1.00 through 4.00 should be updated when a fix is available. As a temporary workaround, consider restricting access to the module set function within the nbr cwmp.lua file until a patch is available.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-56095

Affected Products

Rg-Ew1200G Pro

References · 6

• 🔥 https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56095.md · Exploit
• 🔥 https://1drv.ms/t/c/12406a392c92914b/EQgGsVREbAJEv4dCG7LAzoYBUiS4nCjWKun_QhenDHzU0Q?e=Ly0lll · Exploit
• 🔥 https://1drv.ms/f/c/12406a392c92914b/EkH0xWseMXBJg-Ck_uD34fcB-3pDo3MAQc2AKNlXqwYr2w?e=GU9l62 · Exploit
• https://osv.dev/vulnerability/CVE-2025-56095 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-56095 · Security Note
• https://twitter.com/CVEnew/status/2000246158006923346 · Twitter Post