PT-2025-50688 · Ruijie · Ruijie X60 Pro

Flegoity · Published 2025-12-11 · Updated 2025-12-14 · CVE-2025-56124

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ruijie X60 PRO versions V1.00 through V2.00

Description An issue exists in Ruijie X60 PRO that allows attackers to execute arbitrary commands. This is due to an OS Command Injection flaw present in the module get function within the /usr/local/lua/dev sta/networkConnect.lua file. Exploitation occurs through a crafted POST request. The module get function is vulnerable.

Recommendations Update Ruijie X60 PRO to a version later than V2.00.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-56124

Affected Products

Ruijie X60 Pro

References · 6

• 🔥 https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56124.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-56124 · Security Note
• https://osv.dev/vulnerability/CVE-2025-56124 · Vendor Advisory
• https://1drv.ms/t/c/12406a392c92914b/EWnUygFXeTVNigjp81gJ3LQBJ-hCSb_Yq4gGIMxlan7uJg?e=emOIoc · Note
• https://twitter.com/CVEnew/status/2000246180672881151 · Twitter Post
• https://1drv.ms/f/c/12406a392c92914b/EqOEJce7qVtBlzpFonUkSfYBz09eegk6KowUdpDNexgUvw?e=qfwDKh · Note