Which versions of Ruijie EG105G-P are affected by CVE-2026-12197?

The Ruijie EG105G-P 2.340 gateway router contains an unpatched command injection vulnerability (CVE-2026-12197) that allows authenticated users to completely compromise network infrastructure…

Is there a public PoC exploit available for CVE-2026-12197?

Yes, a public proof-of-concept exploit is available for CVE-2026-12197. Prioritise patching immediately. EPSS: 2.4%.

How to fix or mitigate CVE-2026-12197?

Within 24 hours: Audit all Ruijie EG105G-P 2.340 gateways in production and restrict administrative interface access (/cgi-bin/luci endpoints) to trusted networks only; disable remote management if not required. Within 7 days: Implement network access controls limiting device management to secured jump hosts or VPN, enforce multi-factor authentication on administrative accounts, and review access logs for unauthorized activity. Within 30 days: Execute replacement of all affected devices, prioritizing those handling sensitive traffic; evaluate alternative gateway solutions with active vendor security support.

Ruijie EG105G-P CVE-2026-12197

Q: What is the CVSS score of CVE-2026-12197?

CVE-2026-12197 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.4%.

EUVD-2026-36673 HIGH

Command Injection (CWE-77)

2026-06-14 VulDB

GHSA-f7mp-cw7j-wx85

Command Injection Eg105G P Ruijie

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable management endpoint (AV:N), straightforward injection (AC:L), but requires admin login to call the diagnose API (PR:H); successful injection yields full OS-level control of the device (C/I/A:H).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 00:26 vuln.today

CVSS changed

Jun 15, 2026 - 00:22 NVD

8.6 (HIGH) 7.3 (HIGH)

DescriptionCVE.org

A security flaw has been discovered in Ruijie EG105G-P 2.340. The impacted element is the function nslookup of the file /cgi-bin/luci/api/diagnose of the component JSON-RPC Diagnose Endpoint. Performing a manipulation of the argument params.target results in command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Command injection in the Ruijie EG105G-P 2.340 gateway router allows authenticated remote attackers to execute arbitrary OS commands by manipulating the params.target argument of the nslookup function in the /cgi-bin/luci/api/diagnose JSON-RPC endpoint. Publicly available exploit code exists, the vendor did not respond to coordinated disclosure, and successful exploitation yields full confidentiality, integrity, and availability impact on the device.

Technical ContextAI

The Ruijie EG105G-P is a small-business edge gateway whose web management interface is built on LuCI, a Lua-based configuration framework commonly used on OpenWrt-derived embedded firmware. The diagnostic JSON-RPC handler at /cgi-bin/luci/api/diagnose exposes a server-side nslookup function that takes a user-supplied params.target value and passes it into a shell command without adequate sanitization. This is a textbook CWE-77 (Improper Neutralization of Special Elements used in a Command) issue, where shell metacharacters such as ';', '|', '`', or '$()' embedded in the target field are interpreted by the underlying shell, letting the attacker append arbitrary commands to the intended nslookup invocation.

RemediationAI

No vendor-released patch identified at time of analysis - Ruijie did not respond to VulDB's coordinated disclosure, so defenders should treat the issue as unfixed. As compensating controls, restrict the EG105G-P management interface to a dedicated management VLAN or trusted source IPs via ACLs so that /cgi-bin/luci/api/diagnose is unreachable from the WAN and general LAN (side effect: legitimate admins must use a jump host), rotate and harden administrator credentials and disable any default accounts to raise the cost of meeting the PR:H precondition, and consider blocking or web-application-filtering POST requests to /cgi-bin/luci/api/diagnose whose JSON body contains shell metacharacters in the params.target field (side effect: may break legitimate diagnostic use of the panel). Monitor VulDB entry https://vuldb.com/vuln/370840 and the vendor portal for a firmware release superseding 2.340, and consult the public PoC at https://github.com/ictrun/java/issues/6 to build detection signatures.