# CVE-2026-92397: Ruijie RG-EW3000GX OS command injection in configChange

Source: https://junglewise.ai/threats/cve-2026-92397-ruijie-rg-ew3000gx-os-command-injection-in-configchange  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92397 · Severity: critical · CVSS 9.1 · Published 2026-09-16

Ruijie RG-EW3000GX is a wireless access point used to provide network connectivity in enterprise environments. A remote attacker can inject arbitrary operating system commands through the configChange function, allowing complete compromise of the device and potential lateral movement into the network.

Vendors: [Ruijie](https://junglewise.ai/threats/vendors/ruijie).

## Quick answers

**Is CVE-2026-92397 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92397 being exploited in the wild.

**How severe is CVE-2026-92397?** Critical severity, with a CVSS score of 9.1, published 16 September 2026.

**Which products and versions are affected?** Ruijie RG-EW3000GX EW_3.0(1)B11P380.

**Is there a fix for CVE-2026-92397?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92397 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-92397?** Check whether you run Ruijie RG-EW3000GX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the cc_set function of the unifyframe-sgi.elf component in Ruijie RG-EW3000GX firmware EW_3.0(1)B11P380. The configChange functionality fails to properly validate the data.url argument before passing it to an OS command execution context, allowing OS command injection. The attack is remotely exploitable without authentication. An attacker can execute arbitrary commands with device privileges, leading to complete device compromise, data theft, or use as a pivot point for network attacks.

## Affected products

- Ruijie RG-EW3000GX EW_3.0(1)B11P380

## Timeline

- 2026-09-16: disclosed

## References

- [https://github.com/FoundTL/RG-EW3000GX/blob/main/RG-EW3000GX_unifyframe-sgi.elf.md](https://github.com/FoundTL/RG-EW3000GX/blob/main/RG-EW3000GX_unifyframe-sgi.elf.md)
- [https://vuldb.com/cve/CVE-2026-92397](https://vuldb.com/cve/CVE-2026-92397)