CVE-2025-56102: Command Injection

Published Dec 11, 2025

Updated

OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226EW1800GX10223121 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleget in file /usr/local/lua/devsta/networkConnect.lua.

Affected Software

5 affected components

Ruijie RG-EW1800GX

All of the following

Ruijie Rg-ew1800gx Firmware=3.0\(1\)b11p226

Ruijie RG-EW1800GX

All of the following

Ruijie Rg-ew300r Firmware=3.0\(1\)b11p301

Ruijie Rg-ew300r

Event History

Dec 11, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-56102?

CVE-2025-56102 is considered a high-severity vulnerability due to its potential to allow arbitrary command execution.

How do I fix CVE-2025-56102?

To fix CVE-2025-56102, apply the latest firmware update provided by Ruijie for the RG-EW1800GX device.

What types of attacks are possible with CVE-2025-56102?

CVE-2025-56102 allows attackers to execute arbitrary system commands, which could lead to unauthorized access or control of the device.

Which software is affected by CVE-2025-56102?

CVE-2025-56102 affects the Ruijie RG-EW1800GX device with the specified firmware version B11P226_EW1800GX_10223121.

How can I detect exploitation of CVE-2025-56102?

Monitoring unusual POST requests targeting the /usr/local/lua/dev_sta/networkConnect.lua file can help detect potential exploitation of CVE-2025-56102.