{"id":"CVE-2023-38902","aliases":["EUVD-2023-42663","GHSA-qf45-5h68-rp79"],"status":"published","title":"An issue in RG-EW series home routers and repeaters v.EW_3.0(1)B11P204, RG-NBS and RG-S1930...","description":"A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers v.EG_3.0(1)B11P219, EAP and RAP series wireless access points v.AP_3.0(1)B11P219, and NBC series wireless controllers v.AC_3.0(1)B11P219 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /cgi-bin/luci/api/cmd via the remoteIp field.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02582,"percentile":0.85338,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-77"],"published":"2023-08-17T00:00:00Z","modified":"2026-06-17T06:11:17Z","products":[{"vendor":"ruijie","product":"nbc_series_wireless_controllers"},{"vendor":"ruijie","product":"rg-eap101_firmware"},{"vendor":"ruijie","product":"rg-eap101_v2_firmware"},{"vendor":"ruijie","product":"rg-eap102\\(f\\)_firmware"},{"vendor":"ruijie","product":"rg-eap102_firmware"},{"vendor":"ruijie","product":"rg-eap102_v2_firmware"},{"vendor":"ruijie","product":"rg-eap162\\(g\\)_firmware"},{"vendor":"ruijie","product":"rg-eap201_firmware"},{"vendor":"ruijie","product":"rg-eap202_firmware"},{"vendor":"ruijie","product":"rg-eap212\\(f\\)_firmware"},{"vendor":"ruijie","product":"rg-eap212\\(g\\)_firmware"},{"vendor":"ruijie","product":"rg-eap262\\(g\\)_firmware"},{"vendor":"ruijie","product":"rg-eap602_firmware"},{"vendor":"ruijie","product":"rg-eap662\\(g\\)_firmware"},{"vendor":"ruijie","product":"rg-eg"},{"vendor":"ruijie","product":"rg-eg105g-e_firmware"},{"vendor":"ruijie","product":"rg-eg105g-pe_firmware"},{"vendor":"ruijie","product":"rg-eg105g_v2_firmware"},{"vendor":"ruijie","product":"rg-eg210g-e_firmware"},{"vendor":"ruijie","product":"rg-eg210g-p_firmware"},{"vendor":"ruijie","product":"rg-eg210g-pe_firmware"},{"vendor":"ruijie","product":"rg-ew"},{"vendor":"ruijie","product":"rg-ew1200_firmware"},{"vendor":"ruijie","product":"rg-ew1200g_pro_firmware"},{"vendor":"ruijie","product":"rg-ew1200r_firmware"},{"vendor":"ruijie","product":"rg-ew1300g_firmware"},{"vendor":"ruijie","product":"rg-ew1800gx_pro_firmware"},{"vendor":"ruijie","product":"rg-ew3000gx_pro_firmware"},{"vendor":"ruijie","product":"rg-ew300_pro_firmware"},{"vendor":"ruijie","product":"rg-ew300r_firmware"},{"vendor":"ruijie","product":"rg-ew3200gx_pro_firmware"},{"vendor":"ruijie","product":"rg-ew_series_routers_and_repeaters"},{"vendor":"ruijie","product":"rg-nb3200-24gt4xs_firmware"},{"vendor":"ruijie","product":"rg-nbc256_firmware"},{"vendor":"ruijie","product":"rg-nbc512_firmware"},{"vendor":"ruijie","product":"rg-nbs1850gc_firmware"},{"vendor":"ruijie","product":"rg-nbs1850gc_v2_firmware"},{"vendor":"ruijie","product":"rg-nbs2000_firmware"},{"vendor":"ruijie","product":"rg-nbs2009g-p_firmware"},{"vendor":"ruijie","product":"rg-nbs200_firmware"},{"vendor":"ruijie","product":"rg-nbs2026g-p_firmware"},{"vendor":"ruijie","product":"rg-nbs2026g_firmware"},{"vendor":"ruijie","product":"rg-nbs226f_firmware"},{"vendor":"ruijie","product":"rg-nbs228f_firmware"},{"vendor":"ruijie","product":"rg-nbs252f_firmware"},{"vendor":"ruijie","product":"rg-nbs3100-24gt4sfp-p_firmware"},{"vendor":"ruijie","product":"rg-nbs3100-24gt4sfp-p_v2_firmware"},{"vendor":"ruijie","product":"rg-nbs3100-24gt4sfp_firmware"},{"vendor":"ruijie","product":"rg-nbs3100-48gt4sfp_firmware"},{"vendor":"ruijie","product":"rg-nbs3100-8gt2sfp-p_firmware"},{"vendor":"ruijie","product":"rg-nbs3100-8gt2sfp_firmware"},{"vendor":"ruijie","product":"rg-nbs3200-24gt4xs-p_firmware"},{"vendor":"ruijie","product":"rg-nbs3200-24sfp\\/8gt4xs_firmware"},{"vendor":"ruijie","product":"rg-nbs3200-48gt4xs-p_firmware"},{"vendor":"ruijie","product":"rg-nbs3200-48gt4xs_firmware"},{"vendor":"ruijie","product":"rg-nbs5100-24gt4sfp_firmware"},{"vendor":"ruijie","product":"rg-nbs5100-48gt4sfp_firmware"},{"vendor":"ruijie","product":"rg-nbs5200-24gt4x_firmware"},{"vendor":"ruijie","product":"rg-nbs5200-24sfp\\/8gt4xs_firmware"},{"vendor":"ruijie","product":"rg-nbs5200-48gt4xs_firmware"},{"vendor":"ruijie","product":"rg-nbs5300-48mg6xs_firmware"},{"vendor":"ruijie","product":"rg-nbs5528xg_firmware"},{"vendor":"ruijie","product":"rg-nbs5552xg_firmware"},{"vendor":"ruijie","product":"rg-nbs5552xg_v2.0_firmware"},{"vendor":"ruijie","product":"rg-nbs5628xg_firmware"},{"vendor":"ruijie","product":"rg-nbs5652xg_firmware"},{"vendor":"ruijie","product":"rg-nbs5710-24gt4sfp-e-p_firmware"},{"vendor":"ruijie","product":"rg-nbs5710-24gt4sfp-e_firmware"},{"vendor":"ruijie","product":"rg-nbs5710-48gt4sfp-e_firmware"},{"vendor":"ruijie","product":"rg-nbs5750-28gt4xs-e_firmware"},{"vendor":"ruijie","product":"rg-nbs5750v2-24gt4xs-e_firmware"},{"vendor":"ruijie","product":"rg-nbs5750v2-24sfp4xs-e_firmware"},{"vendor":"ruijie","product":"rg-nbs5750v2-48gt4xs-e_firmware"},{"vendor":"ruijie","product":"rg-nbs5816xs_firmware"},{"vendor":"ruijie","product":"rg-nbs6002_firmware"},{"vendor":"ruijie","product":"rg-nbs6100-20xs4vs2qxs-s_firmware"},{"vendor":"ruijie","product":"rg-nbs7003_firmware"},{"vendor":"ruijie","product":"rg-nbs7006_firmware"},{"vendor":"ruijie","product":"rg-rap100_firmware"},{"vendor":"ruijie","product":"rg-rap1200\\(e\\)_firmware"},{"vendor":"ruijie","product":"rg-rap1200\\(f\\)_firmware"},{"vendor":"ruijie","product":"rg-rap120_firmware"},{"vendor":"ruijie","product":"rg-rap120v2_firmware"},{"vendor":"ruijie","product":"rg-rap1260\\(g\\)_firmware"},{"vendor":"ruijie","product":"rg-rap2200\\(e\\)_firmware"},{"vendor":"ruijie","product":"rg-rap2200\\(f\\)_firmware"},{"vendor":"ruijie","product":"rg-rap2200\\(g\\)_firmware"},{"vendor":"ruijie","product":"rg-rap2260\\(e\\)_firmware"},{"vendor":"ruijie","product":"rg-rap2260\\(g\\)_firmware"},{"vendor":"ruijie","product":"rg-rap6260\\(g\\)_firmware"},{"vendor":"ruijie","product":"rg-rap6261\\(cd\\)_firmware"},{"vendor":"ruijie","product":"rg-rap6261\\(e\\)_firmware"},{"vendor":"ruijie","product":"rg-rap630cd_firmware"},{"vendor":"ruijie","product":"rg-rap630ioda_firmware"},{"vendor":"ruijie","product":"rg-s1930"},{"vendor":"ruijie","product":"rg-s1930-24gt4sfp_firmware"},{"vendor":"ruijie","product":"rg-s1930-24t4sfp-p_firmware"},{"vendor":"ruijie","product":"rg-s1930-24t4sfp_firmware"},{"vendor":"ruijie","product":"rg-s1930-8gt2sfp-p_firmware"},{"vendor":"ruijie","product":"rg-s1930-8gt2sfp_firmware"},{"vendor":"ruijie","product":"rg-s1930-8t2sfp-p_firmware"}],"references":[{"url":"https://gist.github.com/ZIKH26/18693c67ee7d2f8d2c60231b19194c37","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38902"},{"url":"http://rg-ew.com"},{"url":"http://ruijie.com"},{"url":"https://github.com/advisories/GHSA-qf45-5h68-rp79"}],"sources":{"cve":[{"id":"CVE-2023-38902","description":"A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers v.EG_3.0(1)B11P219, EAP and RAP series wireless access points v.AP_3.0(1)B11P219, and NBC series wireless controllers v.AC_3.0(1)B11P219 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /cgi-bin/luci/api/cmd via the remoteIp field.","status":"published","published":"2023-08-17T00:00:00Z","modified":"2024-10-08T14:50:58.719Z","updated_at":"2026-11-02T14:35:29.772612Z"}],"euvd":[{"id":"EUVD-2023-42663","description":"A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers v.EG_3.0(1)B11P219, EAP and RAP series wireless access points v.AP_3.0(1)B11P219, and NBC series wireless controllers v.AC_3.0(1)B11P219 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /cgi-bin/luci/api/cmd via the remoteIp field.","status":"published","published":"2023-08-17T00:00:00Z","modified":"2024-10-08T14:50:58Z","updated_at":"2026-11-03T00:27:45.808193Z"}],"ghsa":[{"id":"GHSA-qf45-5h68-rp79","title":"An issue in RG-EW series home routers and repeaters v.EW_3.0(1)B11P204, RG-NBS and RG-S1930...","description":"An issue in RG-EW series home routers and repeaters v.EW_3.0(1)B11P204, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P218, RG-EG series business VPN routers v.EG_3.0(1)B11P216, EAP and RAP series wireless access points v.AP_3.0(1)B11P218, and NBC series wireless controllers v.AC_3.0(1)B11P86 allows a remote attacker to execute arbitrary code via the unifyframe-sgi.elf component in sub_40DA38.","status":"published","published":"2023-08-17T15:30:22Z","modified":"2024-04-04T07:01:40Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:56:47.648865Z"}],"nvd":[{"id":"CVE-2023-38902","description":"A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers v.EG_3.0(1)B11P219, EAP and RAP series wireless access points v.AP_3.0(1)B11P219, and NBC series wireless controllers v.AC_3.0(1)B11P219 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /cgi-bin/luci/api/cmd via the remoteIp field.","status":"published","published":"2023-08-17T13:15:11.347Z","modified":"2026-06-17T06:11:17.24Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:08:24.487686Z"}]}}