PT-2025-50680 · Ruijie · Rg-Bcr860

Published 2025-12-11 · Updated 2026-01-07 · CVE-2025-56111

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ruijie RG-BCR RG-BCR860 (affected versions not specified)

Description An issue exists that allows attackers to execute arbitrary commands. This can be achieved by sending a specially crafted POST request to the /usr/lib/lua/luci/controller/admin/netport.lua file, specifically targeting the network set wan conf function. The vulnerability is an OS Command Injection, meaning malicious code can be injected into the system through this request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-56111

Affected Products

Rg-Bcr860

References · 7

• 🔥 https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56111.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-56111 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-56111 · Security Note
• https://1drv.ms/f/c/12406a392c92914b/EqEQemupso9DldgG-EcUI8IBLpEWP_S-f6vpeUtYztYYCg?e=gX4A10 · Note
• https://twitter.com/CVEnew/status/2000246171583828143 · Twitter Post
• https://t.me/cveNotify/147978 · Telegram Post
• https://1drv.ms/t/c/12406a392c92914b/ERJa0DnnR29MqtbLLRQirGYB4qA9dAdpn6eIJH9LwNlBmw?e=y6KkGo · Note