CVE-2026-92398

The Ruijie RG-EW3000GX Wi-Fi router running firmware EW_3.0(1)B11P380 contains an OS command injection flaw (CWE-77/CWE-78) in the user_list_note module, which handles the file /etc/rg_config/admin. A remote attacker who already holds administrative privileges manipulates the 'Name' argument, causing injected commands to be executed on the router's operating system; the CVSS 4.0 vector (PR:H) confirms admin-level access is required, so this is not an unauthenticated bug. Successful exploitation yields full command execution on the device, with confidentiality, integrity and availability impacts rated high for both the router and subsequent (downstream) systems, effectively letting an attacker take over the gateway and pivot into the network behind it. Only the RG-EW3000GX on build EW_3.0(1)B11P380 is confirmed affected; other firmware builds or EW-series models are not ruled out but are not documented in the advisory. The advisory states the exploit has been made public and could be used, though no standalone PoC is catalogued in this listing and the flaw is not yet in CISA's Known Exploited Vulnerabilities catalog.

What to do: Upgrade the RG-EW3000GX to a firmware release newer than EW_3.0(1)B11P380 as soon as Ruijie publishes a fix (no fixed version is named in the advisory); until then, disable WAN-side/remote administration and restrict the management interface to trusted LAN clients or management allowlists. Rotate administrative credentials and audit the admin/user list configuration (the user_list_note module and /etc/rg_config/admin data) for unauthorized accounts, since that is the component under attack. Because exploitation requires admin-level privileges, exposed management ports combined with weak or reused passwords are the main risk multipliers — prioritize internet-reachable devices.