Executive brief
A security vulnerability exists in the Ruijie Reyee EG105G-P series of network routers. These devices are commonly used to manage business network traffic and provide power to connected devices like cameras or access points. An attacker with administrative access can exploit a flaw in the device's diagnostic tools to take full control of the router's operating system, potentially leading to network eavesdropping or service disruption.
Technical details
An OS command injection vulnerability exists in the JSON-RPC diagnose endpoint (/cgi-bin/luci/api/diagnose) of Ruijie Reyee EG105G-P devices. The root cause is the improper neutralization of special characters in the 'params.target' argument within the 'nslookup' function. While 'ping' and 'traceroute' functions correctly use shell quoting (%q), the 'nslookup' function uses a raw string format (%s), allowing an attacker to inject newline characters followed by arbitrary shell commands. Exploitation requires a valid administrative session ID (sid). Successful exploitation allows an attacker to execute commands with the privileges of the EWEB/LuCI backend process. No official patch has been confirmed by the vendor at the time of disclosure.
Affected products
- Ruijie Reyee EG105G-P / RG-EG105G-P V2 ReyeeOS 1.202.2428; ReyeeOS 2.340; EG_3.0(1)B11P340
Timeline
- 2026-06-15: advisory: NVD publication date
- 2026-05-14: other: Vulnerability reproduction and PoC creation date mentioned in logs