Rg Ew3000Gx
Monthly
A high-privileged authenticated attacker can inject and execute arbitrary operating-system commands on the Ruijie RG-EW3000GX router running firmware EW_3.0(1)B11P380, through the user_list_note functionality that manipulates the Name argument resolved from /etc/rg_config/admin. The vulnerability is network-reachable and requires no user interaction, but the CVSS vector (PR:H) confirms it is only exploitable after obtaining administrator credentials for the device management interface, so anonymous internet attackers cannot reach it directly. Publicly available exploit code exists (a GitHub proof-of-concept for the RG-EW3000GX user_list_note flaw), which materially raises the likelihood of post-authentication abuse, particularly on routers whose management plane is exposed to the WAN or protected by weak/default admin passwords; no CISA KEV entry has been reported for this CVE.
OS command injection in the Ruijie RG-EW3000GX router (firmware EW_3.0(1)B11P380) lets an attacker who already holds a valid administrator session execute arbitrary shell commands on the device by injecting metacharacters into the data.url argument of a configChange request handled by the cc_set function in unifyframe-sgi.elf. Exploitation is remote and low-complexity once admin access is obtained, and publicly available exploit code exists (PoC disclosed via GitHub and VulDB), though there is no CISA KEV confirmation of active exploitation. Because the CVSS vector carries PR:H and the independent assessment confirms the configChange/cc_set path is not reachable pre-authentication, this is a real but privilege-gated vulnerability rather than an unauthenticated takeover.
A high-privileged authenticated attacker can inject and execute arbitrary operating-system commands on the Ruijie RG-EW3000GX router running firmware EW_3.0(1)B11P380, through the user_list_note functionality that manipulates the Name argument resolved from /etc/rg_config/admin. The vulnerability is network-reachable and requires no user interaction, but the CVSS vector (PR:H) confirms it is only exploitable after obtaining administrator credentials for the device management interface, so anonymous internet attackers cannot reach it directly. Publicly available exploit code exists (a GitHub proof-of-concept for the RG-EW3000GX user_list_note flaw), which materially raises the likelihood of post-authentication abuse, particularly on routers whose management plane is exposed to the WAN or protected by weak/default admin passwords; no CISA KEV entry has been reported for this CVE.
OS command injection in the Ruijie RG-EW3000GX router (firmware EW_3.0(1)B11P380) lets an attacker who already holds a valid administrator session execute arbitrary shell commands on the device by injecting metacharacters into the data.url argument of a configChange request handled by the cc_set function in unifyframe-sgi.elf. Exploitation is remote and low-complexity once admin access is obtained, and publicly available exploit code exists (PoC disclosed via GitHub and VulDB), though there is no CISA KEV confirmation of active exploitation. Because the CVSS vector carries PR:H and the independent assessment confirms the configChange/cc_set path is not reachable pre-authentication, this is a real but privilege-gated vulnerability rather than an unauthenticated takeover.