CVE-2026-12197
HighCVSS 7.2Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
A security flaw has been discovered in Ruijie EG105G-P 2.340 in the nslookup function of the /cgi-bin/luci/api/diagnose file, affecting the JSON-RPC Diagnose Endpoint component. Manipulating the params.target argument leads to command injection, allowing for remote attacks.
Risk Assessment
This vulnerability poses a serious risk to organizations as it allows unauthorized users to execute commands remotely. The public release of exploits increases the likelihood of attacks.
Recommendation
It is recommended to immediately update the device to the latest firmware version to mitigate this vulnerability. Additionally, monitoring systems for unauthorized activities is advised.
Original NVD description (English source)
A security flaw has been discovered in Ruijie EG105G-P 2.340. The impacted element is the function nslookup of the file /cgi-bin/luci/api/diagnose of the component JSON-RPC Diagnose Endpoint. Performing a manipulation of the argument params.target results in command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.