CVE-2025-11141: Ruijie NBR2100G-E Router RCE Vulnerability

CVE-2025-11141 Overview

CVE-2025-11141 is an operating system (OS) command injection vulnerability in the Ruijie NBR2100G-E router affecting firmware builds up to 20250919. The flaw resides in the listAction function of /itbox_pi/branch_passw.php?a=list, where the city parameter is passed to a shell context without proper sanitization. An authenticated remote attacker can inject arbitrary OS commands through this parameter. Public exploit details have been released, and additional parameters in the same endpoint may be affected. The vendor was contacted prior to disclosure but did not respond. The weakness is classified under CWE-77: Improper Neutralization of Special Elements used in a Command.

Critical Impact

Authenticated attackers with high privileges can execute arbitrary operating system commands on affected Ruijie NBR2100G-E devices by manipulating the city parameter, with public exploit information already circulating.

Affected Products

• Ruijie NBR2100G-E firmware builds up to and including 20250919
• /itbox_pi/branch_passw.php endpoint invoking listAction
• Potentially other parameters processed by the same endpoint

Discovery Timeline

• 2025-09-29 - CVE-2025-11141 published to the National Vulnerability Database (NVD)
• 2026-10-09 - Last updated in NVD database

Technical Details for CVE-2025-11141

Vulnerability Analysis

The vulnerability is an OS command injection within the listAction handler of the PHP script /itbox_pi/branch_passw.php?a=list. User-supplied input in the city HTTP parameter is incorporated into a system command without proper neutralization of shell metacharacters. Attackers who hold valid credentials on the management interface can append or chain commands using characters such as ;, |, backticks, or $() to execute arbitrary binaries in the context of the web application process.

Because the Ruijie NBR2100G-E is a small-business routing and management appliance, successful exploitation can disclose configuration data, modify network routing behavior, or stage further intrusion into connected network segments. The advisory also notes that other parameters on the same endpoint may be vulnerable, expanding the exploitable surface beyond the city field.

Root Cause

The root cause is the direct concatenation of user-controlled HTTP input into an operating-system command string executed by the PHP backend. The handler does not validate, encode, or allowlist values for city before passing them to a shell interpreter, satisfying the conditions of [CWE-77].

Attack Vector

Exploitation is performed remotely over the network against the device's management web interface. The attacker must already hold high-privilege credentials to reach listAction. Once authenticated, the attacker issues a crafted HTTP request to /itbox_pi/branch_passw.php?a=list with a shell metacharacter payload in the city parameter. The injected command executes in the context of the web server process. Public technical details are available in the GitHub issue tracking this CVE and the VulDB entry 326218.

No verified exploit code is reproduced here; refer to the published references for payload specifics.

Detection Methods for CVE-2025-11141

Indicators of Compromise

• HTTP requests to /itbox_pi/branch_passw.php?a=list containing shell metacharacters (;, |, &, backtick, $() in the city parameter or adjacent fields.
• Unexpected child processes spawned by the device's web server (for example, sh, wget, curl, nc) during or shortly after requests to the affected endpoint.
• Outbound connections from the router management plane to unknown hosts following administrative sessions.

Detection Strategies

• Inspect web access logs on the device or upstream reverse proxies for requests to branch_passw.php with non-alphanumeric characters in query parameters.
• Deploy network intrusion detection signatures that match command-injection payload patterns targeting the city parameter of the itbox_pi path.
• Correlate administrative authentications with subsequent anomalous outbound traffic from the appliance's management IP.

Monitoring Recommendations

• Forward device management logs and NetFlow or firewall telemetry to a centralized analytics platform for retention and correlation.
• Alert on any administrative account activity against the NBR2100G-E outside of defined change windows.
• Review for unauthorized account creation, firmware changes, or configuration exports after any suspicious request to the vulnerable endpoint.

How to Mitigate CVE-2025-11141

Immediate Actions Required

• Restrict access to the device management interface to a dedicated administrative VLAN or jump host, blocking exposure to untrusted networks.
• Rotate all administrative credentials on affected NBR2100G-E devices and enforce strong, unique passwords.
• Audit account inventory on the device and remove any accounts that are not required for operations.
• Review recent web access logs on the appliance for prior exploitation attempts against /itbox_pi/branch_passw.php.

Patch Information

At the time of publication, Ruijie had not issued a public response or patch for CVE-2025-11141. The disclosure references note the vendor was contacted but did not reply. Operators should monitor the Ruijie security advisory channel and the VulDB entry 326218 for updates and apply firmware fixes as soon as they are released.

Workarounds

• Place the management interface behind a VPN or firewall rule set that permits only trusted source addresses.
• Disable or filter access to the /itbox_pi/branch_passw.php endpoint at an upstream web application firewall if feasible.
• Enforce administrative session timeouts and multi-factor authentication on any jump hosts used to reach the device.
• Consider replacing exposed appliances with supported hardware if a vendor fix is not forthcoming.

# Example upstream firewall restriction (iptables)
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP