Executive Summary

CVE-2026-12197 is an authenticated command injection vulnerability found in the Ruijie Reyee EG105G-P web management interface, specifically in the JSON-RPC diagnose endpoint at POST /cgi-bin/luci/api/diagnose. The vulnerability exists in the nslookup diagnostic method where the user-controlled parameter params.target is inserted into a shell command without proper shell quoting.

An attacker with valid authentication credentials can manipulate params.target by including a newline character to terminate the intended nslookup command and inject additional shell commands. This allows remote command execution on the device.

The vulnerability affects multiple firmware versions and can be exploited remotely over HTTP if the web management interface is accessible.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with administrator-level authentication to execute arbitrary shell commands remotely on the affected device.

Successful exploitation can lead to full compromise of the device, including unauthorized access, data theft, disruption of network services, or using the device as a foothold for further attacks within the network.

Because the exploit has been publicly released, the risk of attacks leveraging this vulnerability is increased.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious JSON-RPC calls to the endpoint /cgi-bin/luci/api/diagnose, specifically POST requests invoking the nslookup method with manipulated params.target values.

One way to detect exploitation attempts is to look for unusual command injection patterns such as newline characters or unexpected shell commands embedded in the params.target argument.

For example, you can use network traffic inspection tools or web server logs to search for POST requests containing the nslookup method and suspicious payloads.

• Use tools like tcpdump or Wireshark to capture HTTP POST traffic to /cgi-bin/luci/api/diagnose.
• Search web server logs for POST requests with 'nslookup' and unusual characters in params.target, such as newline characters (%0a or \n).
• Example grep command on logs: grep -i 'nslookup' /var/log/httpd/access.log | grep -E '%0a|\n'
• Monitor for unexpected outbound connections initiated by the device, which may indicate command injection exploitation (e.g., curl requests to external hosts).

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the web management interface to trusted networks only, preventing unauthorized remote access.

Monitor and block suspicious JSON-RPC calls to the /cgi-bin/luci/api/diagnose endpoint, especially those invoking the nslookup method with unusual parameters.

Ensure that only authenticated and authorized users have access to the device management interface, as the exploit requires valid credentials.

Long-term remediation involves vendor patching to fix the command injection by avoiding shell string concatenation, using safer argument-vector execution APIs, and implementing strict input validation and quoting.

Useful 0 Not Useful 0