CVE-2025-56099CWE-78command-injection

CVE-2025-56099

High · published December 12, 2025

CVSS v3.1
8.8
EPSS
2%
Percentile
76.5
In the wild
Unconfirmed
What it is

⚡ An OS Command Injection in Ruijie RG-YST AP could turn your network device into a puppet on strings! 🎭 Think of it like a restaurant kitchen where a rogue diner whispers a secret recipe change to the chef — if the chef follows that order without questioning, the entire menu could be altered. That's how an attacker can issue arbitrary commands to your device through this vulnerability! The consequences are significant; an attacker could run any command they desire on your system, effectively taking control of it. This could lead to unauthorized access, data theft, or even using your device as a launching point for larger attacks. It’s a virtual doomsday for your network security!

Put simply

Think of it like a restaurant kitchen where a rogue diner whispers a secret recipe change to the chef — if the chef follows that order without questioning, the entire menu could be altered. That's how an attacker can issue arbitrary commands to your device through this vulnerability! This vulnerability arises from the ability to send a crafted POST request to the 'pwdmodify' function in the /usr/lib/lua/luci/modules/common.lua file, allowing attackers to execute arbitrary commands without proper validation.

What to do

The consequences are significant; an attacker could run any command they desire on your system, effectively taking control of it. This could lead to unauthorized access, data theft, or even using your device as a launching point for larger attacks. It’s a virtual doomsday for your network security! To protect your network, promptly upgrade to the latest version of the Ruijie RG-YST AP firmware. Regularly audit your network devices for vulnerabilities and implement input validation to prevent command injection attacks. Stay vigilant! You've got this! By taking these steps, you'll be well on your way to securing your systems. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01662 · 76.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-12-12T00:15Z
Affected products (5)
ProductVersionsFixed in
ruijie/rg-yst250f_firmwareall versions—
ruijie/rg-est310_v2_firmwareall versions—
ruijie/reyee_osall versions—
ruijie/reyee_osall versions—
ruijie/rg-eap602_firmwareall versions—
References (3)
EPSS history
Timeline
  • 11 DEC 00:00Z
    OS Command Injection vulnerability in Ruijie RG-YST AP_3.0(1)B11P280YST250F allowing attackers to execute arbitrary commands via a crafted POST request to the…
    cvelistv5