CVE-2025-56120

Name of the Vulnerable Software and Affected Versions Ruijie X60 PRO versions V1.00 through V2.00

Description An OS Command Injection issue exists in Ruijie X60 PRO. Attackers can execute arbitrary commands by sending a specially crafted POST request to the module set function within the /usr/local/lua/dev config/config retain.lua file. The vulnerability allows for the execution of arbitrary commands.

Recommendations Versions V1.00 through V2.00 should be updated to a newer, secure version when available. As a temporary workaround, restrict access to the module set function in /usr/local/lua/dev config/config retain.lua to minimize the risk of exploitation.