CVE-2025-56108CWE-78command-injection

CVE-2025-56108

High · published December 12, 2025

CVSS v3.1
8.8
EPSS
3%
Percentile
85.6
In the wild
Unconfirmed
What it is

⚡ A sneaky OS command injection lurks in Ruijie X30-PRO! A crafted POST request can execute arbitrary commands, like a mischievous chef swapping ingredients in your recipe without telling you. 🍽️ Imagine you're at a restaurant, and the chef starts throwing in secret ingredients without your approval! That's like this vulnerability, where an attacker can dash in commands through an unsuspecting POST request, changing the outcome of your system's 'menu' without permission. With this vulnerability, an attacker could execute arbitrary commands on the system, leading to devastating consequences like data loss, system compromise, or even a full takeover. It’s like giving a stranger the keys to your kitchen and letting them cook whatever chaos they desire!

Put simply

Imagine you're at a restaurant, and the chef starts throwing in secret ingredients without your approval! That's like this vulnerability, where an attacker can dash in commands through an unsuspecting POST request, changing the outcome of your system's 'menu' without permission. This OS command injection vulnerability affects Ruijie X30-PRO, allowing attackers to run any command they choose by exploiting the `pwdmodify` function in the common.lua module through a crafted POST request.

What to do

With this vulnerability, an attacker could execute arbitrary commands on the system, leading to devastating consequences like data loss, system compromise, or even a full takeover. It’s like giving a stranger the keys to your kitchen and letting them cook whatever chaos they desire! To mitigate this risk, patch your Ruijie X30-PRO to the latest version immediately. Make sure to validate and sanitize all incoming data and consider implementing additional layers of security to monitor outgoing commands. You've got this! Follow these steps, and you’ll be well on your way to securing your system! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02661 · 85.6th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-12-12T00:15Z
Affected products (5)
ProductVersionsFixed in
ruijie/x30_pro_firmwareall versions—
ruijie/rg-eap602_firmwareall versions—
ruijie/rg-est350_firmwareall versions—
ruijie/rg-ew300_pro_firmwareall versions—
ruijie/rg-est310_firmwareall versions—
References (3)
EPSS history
Timeline
  • 11 DEC 00:00Z
    OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the…
    cvelistv5