CVE-2026-92397

A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380 within the cc_set function of the file unifyframe-sgi.elf in the configChange component. Manipulation of the data.url argument leads to OS command injection. The attack may be performed remotely, and the exploit has been publicly disclosed.

Since the exploit is publicly available, any network-adjacent attacker can remotely execute arbitrary commands on the device. This could lead to full compromise of the router and the network it manages.

Update the Ruijie RG-EW3000GX firmware to a non-vulnerable version as soon as possible. Until patched, restrict access to the administrative interface and disable remote management from untrusted networks.