OS Command Injection Vulnerability in Ruijie M18 Product

CVE-2025-56089

What is CVE-2025-56089?

An OS Command Injection vulnerability exists in the Ruijie M18 device, allowing attackers to execute arbitrary commands through a specially crafted POST request. The vulnerability resides in the 'module_set' functionality within the /usr/local/lua/dev_sta/nbr_cwmp.lua file, which can be exploited by a malicious actor to gain unauthorized access or control over the system. This flaw poses a significant risk to the integrity of the affected devices, making it critical for users to apply available patches and security measures.

References