EUVD-2026-80852Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable admin endpoint (AV:N/AC:L) but requires administrative authentication (PR:H); command injection yields full device compromise (C/I/A:H), scope unchanged as it affects the device itself.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this vulnerability is the function cc_set of the file unifyframe-sgi.elf of the component configChange. Such manipulation of the argument data.url leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
AnalysisAI
OS command injection in the Ruijie RG-EW3000GX router (firmware EW_3.0(1)B11P380) lets an attacker who already holds a valid administrator session execute arbitrary shell commands on the device by injecting metacharacters into the data.url argument of a configChange request handled by the cc_set function in unifyframe-sgi.elf. Exploitation is remote and low-complexity once admin access is obtained, and publicly available exploit code exists (PoC disclosed via GitHub and VulDB), though there is no CISA KEV confirmation of active exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated administrator session on the RG-EW3000GX web/management interface (CVSS PR:H) - the vulnerable configChange/cc_set path is not reachable pre-authentication. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a real but privilege-gated vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data at time of analysis, and the supplied references are the VulDB entry and a public PoC rather than a Ruijie firmware advisory, so remediation must start with confirming a fixed build with Ruijie support and applying it as soon as one is published (monitor https://vuldb.com/vuln/405549 for updates). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Ruijie RG-EW3000GX units running firmware EW_3.0(1)B11P380, confirm whether any are internet-facing or reachable outside a trusted management network, and immediately restrict administrative access to a dedicated management VLAN or allow-listed IPs; rotate all administrator credentials on affected devices and disable any default or shared accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Rg Ew3000Gx
View allSame weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today