OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the setWisp in file /usr/lib/lua/luci/modules/wireless.lua.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 8.8 · ruijieNVD modified 2026-10-14 20:10
Affected (CPE criteria) 3
cpe:2.3:o:ruijie:x30_pro_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:ruijie:rg-ew300_pro_firmware:3.0\(1\)b11p219:*:*:*:*:*:*:*cpe:2.3:o:ruijie:rg-eap602_firmware:3.0\(1\)b2p55:*:*:*:*:*:*:*
References 4
- https://1drv.ms/f/c/12406a392c92914b/EtGIxwWujwxBvQhL9wgnUIwBkg-mndJJX07Igr6d0cic-g?e=4KJbWY Broken Link, Product
- https://1drv.ms/t/c/12406a392c92914b/Edoz9sBTjeJMqw8K0f3lWgMBNxBlpE9IIUwOX2h2S1cMhw?e=46VlOq Broken Link, Third Party Advisory
- https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56092.md Not Applicable
- https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56093.md Exploit, Third Party Advisory