CVE-2026-12197: Ruijie EG105G-P Command Injection Vulnerability (CVSS 7.2)

Technical summary

CVE-2026-12197 affects the JSON-RPC Diagnose Endpoint in Ruijie EG105G-P 2.340. The vulnerable code path is /cgi-bin/luci/api/diagnose, specifically the nslookup function. Insufficient input validation on the params.target argument allows an authenticated user to break out of the intended command context and inject shell metacharacters, leading to arbitrary command execution with the privileges of the web service process. The vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-77 (Improper Neutralization of Special Elements used in a Command), indicating both encoding and command-level injection flaws.

Business impact

Successful exploitation allows an authenticated user to achieve remote code execution on Ruijie network appliances, potentially leading to complete device compromise. In enterprise deployments where EG105G-P units serve as gateways or diagnostic hubs, this could enable lateral movement, network segmentation bypass, data exfiltration, or denial of service. The availability of public exploit code significantly increases the likelihood of weaponized attacks. Organizations relying on these devices for network management or security appliance functions face direct operational risk.

Affected systems

Ruijie EG105G-P version 2.340 is confirmed affected. The vulnerable endpoint is present in the web administration interface. Organizations using this product should assume exposure unless running a patched version. Verify the exact firmware version on deployed units, as earlier or later versions may also be vulnerable—vendor confirmation is essential before ruling out any deployment.

Exploitability

Exploitation requires authentication to the web interface, which typically means valid administrative credentials or network access to the management VLAN. However, the public availability of exploit code and the relative simplicity of the injection technique lower the barrier for motivated attackers, especially in environments with weak credential hygiene or default credentials. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects network-accessible attack with high privileges required but low attack complexity; the lack of user interaction and universal impact scope indicate severe consequences once the authentication hurdle is cleared.

Remediation

Immediate actions: (1) Verify firmware version on all Ruijie EG105G-P deployments. (2) Restrict administrative web interface access to trusted networks via firewall rules and access control lists. (3) Enforce strong, unique credentials on all management accounts and disable default accounts. (4) Monitor for suspicious diagnostic API calls in access logs. Long-term: Contact Ruijie support directly to obtain patched firmware. Given the vendor's non-responsiveness to early disclosure, monitor the CVE record and community channels for unofficial patches or vendor statements. Consider upgrading to alternative products if vendor support remains unavailable.

Patch guidance

As of the vulnerability publication date, the vendor has not released or announced patches despite early disclosure notification. Do not assume a patch is available; verify directly with Ruijie support for availability and release timelines. If a patch version is released, testing should occur in an isolated lab environment before production deployment, given the security-critical nature of this function. Document the patched firmware version and maintain a record of deployment completion.

Detection guidance

Monitor web server and application logs on affected devices for unusual patterns in /cgi-bin/luci/api/diagnose requests, particularly those containing shell metacharacters (pipe, semicolon, backticks, $(), &, |) in the params.target parameter. Network IDS/IPS signatures should alert on POST requests to this endpoint with suspicious payloads. Endpoint detection should flag command execution spawned from web server processes with unexpected parent-child relationships. Baseline normal diagnostic traffic to identify anomalies; legitimate nslookup operations should use standard domain names without special characters.

Why prioritize this

This vulnerability merits urgent remediation despite the authentication requirement. The combination of public exploit code, remote exploitability, high confidentiality/integrity/availability impact, and vendor non-responsiveness creates significant risk. Any organization with internet-facing or internally-exposed management interfaces must prioritize this immediately. Even in protected environments, the existence of public tooling means compromise is likely if an attacker gains any form of authenticated access—making this a critical chaining vulnerability in multi-stage attacks.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects the severity of command execution with full system impact, but is moderated by the authentication requirement (PR:H). However, this scoring may underestimate real-world risk because: (1) many organizations reuse administrative credentials across devices, (2) the vendor is unresponsive, leaving no clear remediation path, and (3) public exploit code eliminates the need for exploit development. Organizations should treat this as a critical priority in their own risk assessment, particularly for network-critical appliances.

Frequently asked questions