Remote Command Injection in Ruijie RG-EW3000GX

A critical security vulnerability (CVE-2026-92397) has been identified in the Ruijie RG-EW3000GX router, specifically within firmware version EW_3.0(1)B11P380. The vulnerability exists within the 'cc_set' function of the 'unifyframe-sgi.elf' binary, which is part of the 'configChange' component. An attacker can trigger this vulnerability by supplying a malicious payload to the 'data.url' argument. Because the router fails to properly sanitize this input before passing it to the underlying operating system, remote attackers can achieve command injection. This flaw is particularly dangerous as it allows for unauthenticated remote code execution on the networking device, potentially leading to a full compromise of the router, interception of network traffic, or use of the device as a pivot point within the local network. Proof-of-concept exploits have been disclosed publicly, making the risk of exploitation high.

Attack Chain

1. Attacker performs network reconnaissance to identify exposed management interfaces for Ruijie RG-EW3000GX devices.
2. Attacker crafts an HTTP request targeting the 'configChange' component exposed on the device.
3. Attacker injects a malicious command string into the 'data.url' parameter of the 'cc_set' function call.
4. The web service forwards the unsanitized input to the 'unifyframe-sgi.elf' binary.
5. The binary executes the injected command with the privileges of the web service process.
6. The attacker establishes a reverse shell or downloads additional payloads to maintain persistent access to the device.

Impact

Successful exploitation of CVE-2026-92397 grants an attacker unauthenticated remote code execution on the target router. Impact includes the ability to bypass network segmentation, perform man-in-the-middle attacks on connected clients, exfiltrate credentials, and utilize the compromised router as a permanent persistence mechanism or bridge into the internal network environment.

Recommendation

Prioritized actions for security teams:

• Immediately audit perimeter network logs for any HTTP requests containing command injection characters directed at Ruijie RG-EW3000GX devices.
• Patch or update the router firmware to a version beyond EW_3.0(1)B11P380 if available, or restrict access to the device management interface to trusted internal IP ranges only.
• If a patch is unavailable, place affected devices behind a firewall and block external access to administrative endpoints.