BaseFortify

Publication date: 2025-12-11

Last updated on: 2025-12-12

Assigner: MITRE

Description

OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_config/config_retain.lua.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-11

Last Modified

2025-12-12

Generated

2026-07-07

AI Q&A

2025-12-11

EPSS Evaluated

2026-07-06

NVD

CVE-2025-56090

Affected Vendors & Products

Vendor	Product	Version / Range
ruijie	rg-ew1200g_pro	v1.00
ruijie	rg-ew1200g_pro	v4.00
ruijie	rg-ew1200g_pro	v3.00
ruijie	rg-ew1200g_pro	v2.00

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS Command Injection in the Ruijie RG-EW1200G PRO devices (versions V1.00 to V4.00). It allows attackers to execute arbitrary operating system commands by sending a specially crafted POST request to the module_set in the file /usr/local/lua/dev_config/config_retain.lua.

Impact Analysis

An attacker exploiting this vulnerability can execute arbitrary commands on the affected device, potentially gaining unauthorized control, disrupting device functionality, stealing data, or using the device as a foothold for further attacks.

Hi! I’m here to help you understand CVE-2025-56090. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70