← Vulnerability feed

Vulnerability record · CVE-2025-56108 · published 11 December 2025

CVE-2025-56108: Ruijie x30 pro firmware os command injection vulnerability

Ruijie · X30 Pro Firmware

OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua.

8.8 CVSS 3.1 High EPSS 2.7% · top 14.9% CWE-78 · OS command injection
8.8CVSS 3.1 base score
2.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
5Affected product versions listed by NVD
3References, 3 tagged exploit
17 Jun 2026Last modified by NVD

Description

OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://1drv.ms/f/c/12406a392c92914b/EtGIxwWujwxBvQhL9wgnUIwBkg-mndJJX07Igr6d0cic-g?e=4KJbWY Broken LinkExploit
https://1drv.ms/t/c/12406a392c92914b/Ecib6--fxv9HhrfAdhmP5R4BOPDcTcqTOBt0hQBEx5BTxA?e=s3ejN1 Broken LinkExploit
https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56108.md ExploitVendor Advisory

Track CVE-2025-56108 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2025-56117Ruijie x30 pro firmware os command injection vulnerabilityOS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request …EPSS 3.1%8.8CVE-2025-56113Ruijie rg-yst250f firmware os command injection vulnerabilityOS Command Injection vulnerability in Ruijie RG-YST EST, YSTAP_3.0(1)B11P280YST250F V1.xxV2.xx allowing attackers to execute arbitrary commands via a…EPSS 1.7%8.8CVE-2025-56106Ruijie rg-ew1800gx firmware os command injection vulnerabilityOS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226_EW1800GX_10223121 allowing attackers to execute arbitrary commands via a crafted POS…EPSS 2.8%8.8CVE-2025-56093Ruijie x30 pro firmware os command injection vulnerabilityOS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request …EPSS 3.2%8.8CVE-2025-56095Ruijie rg-ew1200g pro firmware os command injection vulnerabilityOS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands v…EPSS 2.8%8.8CVE-2025-56099Ruijie rg-yst250f firmware os command injection vulnerabilityOS Command Injection vulnerability in Ruijie RG-YST AP_3.0(1)B11P280YST250F allowing attackers to execute arbitrary commands via a crafted POST reque…EPSS 1.7%8.8CVE-2025-56094Ruijie x30 pro firmware os command injection vulnerabilityOS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request …EPSS 3.3%8.8CVE-2025-56098Ruijie x30 pro firmware os command injection vulnerabilityOS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request …EPSS 2.6%

Source: NIST National Vulnerability Database (record CVE-2025-56108), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.