PT-2025-50659

CVE-2025-56089

·

Published

2025-12-11

·

Updated

2026-10-14

Description by

CVSS 3.1
8.8
High
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Ruijie M18 EW versions 3.0(1)B11P226 M18 10223116
Description An issue exists that allows attackers to execute arbitrary commands. This can be achieved by sending a specially crafted POST request to the module set component within the file /usr/local/lua/dev sta/nbr cwmp.lua. The vulnerability is an OS Command Injection.
Recommendations Apply updates to address the issue in the affected versions.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')
Related identifiers
CVE-2025-56089
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com