OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
References
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
History
27 Jan 2026, 17:35
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://1drv.ms/f/c/12406a392c92914b/EkH0xWseMXBJg-Ck_uD34fcB-3pDo3MAQc2AKNlXqwYr2w?e=GU9l62 - Broken Link | |
| References | () https://1drv.ms/t/c/12406a392c92914b/ERjNMNZRBD5HoYydt7Kb3kwBT4ycJXROxTsVBB-WXXqH6Q?e=q8Lcd2 - Broken Link | |
| References | () https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56123.md - Exploit, Third Party Advisory | |
| First Time |
Ruijie rg-ew1300g
Ruijie rg-ew1200g Pro Ruijie rg-ew1300g Firmware Ruijie Ruijie rg-ew1200g Pro Firmware |
|
| CPE | cpe:2.3:h:ruijie:rg-ew1200g_pro:4.0:*:*:*:*:*:*:* cpe:2.3:o:ruijie:rg-ew1300g_firmware:ew_3.0\(1\)b11p303:*:*:*:*:*:*:* cpe:2.3:h:ruijie:rg-ew1200g_pro:3.0:*:*:*:*:*:*:* cpe:2.3:h:ruijie:rg-ew1200g_pro:1.0:*:*:*:*:*:*:* cpe:2.3:h:ruijie:rg-ew1300g:-:*:*:*:*:*:*:* cpe:2.3:o:ruijie:rg-ew1200g_pro_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:ruijie:rg-ew1200g_pro:2.0:*:*:*:*:*:*:* |
12 Dec 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CWE | CWE-78 |
11 Dec 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-11 19:15
Updated : 2026-01-27 17:35
NVD link : CVE-2025-56123
Mitre link : CVE-2025-56123
CVE.ORG link : CVE-2025-56123
JSON object : View
Products Affected
ruijie
- rg-ew1300g_firmware
- rg-ew1200g_pro_firmware
- rg-ew1200g_pro
- rg-ew1300g
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')