CVE-2026-92397

CVE-2026-92397 is an operating system command injection vulnerability in the cc_set function of unifyframe-sgi.elf, part of the configChange component of the Ruijie RG-EW3000GX wireless router running firmware EW_3.0(1)B11P380. An attacker sends a crafted request in which the data.url argument is concatenated into a shell command without sanitization, allowing arbitrary OS commands to be executed remotely; per the CVSS 4.0 vector (PR:H), the attack requires an authenticated high-privilege (administrator-level) session but no user interaction. Successful exploitation yields full command execution on the device (confidentiality, integrity and availability impacts all rated High), enabling router takeover, traffic manipulation, and pivoting into the connected LAN. Only RG-EW3000GX units running the affected EW_3.0(1)B11P380 firmware are implicated, a product line typically deployed in SOHO and small-business Wi-Fi networks. The flaw is not listed in CISA KEV and no standalone public PoC has been catalogued, although the source advisory states an exploit has been publicly disclosed; no confirmed in-the-wild exploitation is documented.

What to do: Check the router's firmware version in the admin console and, if it is EW_3.0(1)B11P380, apply the latest EW 3.0 firmware from Ruijie's official support channel (no fixed version is specified in the available data, so confirm the patched release with the vendor). Minimize exposure by disabling remote/WAN management, restricting the management interface to trusted networks, and placing the device behind a firewall where possible. Monitor for unexpected requests to the configChange/unifyframe-sgi.elf handler containing shell metacharacters in the data.url parameter, and rotate administrator credentials on any device that may have been accessed.