CVE-2025-56117: Command Injection
Published Dec 11, 2025
·Updated
OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V109241521 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devsta/nbrcwmp.lua.
Affected Software
5 affected components
Ruijie X30-PRO
All of the following
Ruijie X30 Pro Firmware
Ruijie X30 PRO=1.0
All of the following
Ruijie Rg-est310 Firmware=3.0\(1\)b11p211
Ruijie Rg-est310
Event History
Dec 11, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-56117?
The severity of CVE-2025-56117 is classified as high due to the potential for arbitrary command execution.
2
How do I fix CVE-2025-56117?
To fix CVE-2025-56117, it is recommended to apply the latest firmware update provided by Ruijie for the X30-PRO.
3
What systems are affected by CVE-2025-56117?
CVE-2025-56117 affects the Ruijie X30-PRO model specifically.
4
What type of vulnerability is CVE-2025-56117?
CVE-2025-56117 is classified as an OS Command Injection vulnerability.
5
Can CVE-2025-56117 be exploited remotely?
Yes, CVE-2025-56117 can be exploited remotely through crafted POST requests.