CVE-2026-92398

8.5 highEPSS 3.2%

High (8.5). EPSS 3.2% chance of exploitation in the next 30 days.

A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this issue is some unknown functionality of the file /etc/rg_config/admin of the component user_list_note Module. Performing a manipulation of the argument Name results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

Severity

CVSS 4.0

8.5 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS: 3.2% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CWEs: CWE-77, CWE-78
Published: 2026-09-16
Modified: 2026-09-16
Record from: the NVD, synced 2026-10-19

References

https://github.com/FoundTL/RG-EW3000GX/blob/main/RG-EW3000GX_user_list_note.md
https://vuldb.com/cve/CVE-2026-92398
https://vuldb.com/submit/940182
https://vuldb.com/vuln/405550
https://vuldb.com/vuln/405550/cti

Check your stack JSON