Remote Command Injection in Ruijie Router Diagnostic Endpoint

A security flaw has been discovered in Ruijie EG105G-P 2.340. The impacted element is the function nslookup of the file /cgi-bin/luci/api/diagnose of the component JSON-RPC Diagnose Endpoint. Performing a manipulation of the argument params.target results in command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-12197 is a critical remote command injection vulnerability in Ruijie EG105G-P routers affecting the JSON-RPC diagnostic API endpoint. By manipulating the 'params.target' argument in /cgi-bin/luci/api/diagnose, unauthenticated attackers can execute arbitrary system commands with device privileges. This vulnerability is particularly concerning because Ruijie routers are widely deployed in enterprise and ISP environments, making them attractive targets for lateral movement, persistence, and data exfiltration. The vendor's lack of response to early disclosure combined with public exploit availability significantly increases risk exposure for unpatched installations.

Casky's threat detection framework maps this vulnerability across 419 skills aligned with MITRE ATT&CK, identifying the attack chain across three critical phases: Initial Access (TA0001) through the exposed diagnostic endpoint, Execution (TA0002) via command injection in the nslookup function, and Command & Control (TA0043) for post-exploitation communication. When analyzing network traffic and API logs, practitioners using Casky would detect suspicious JSON-RPC requests with encoded payloads in the params.target field, executable patterns typical of CWE-74 and CWE-77 violations, and subsequent system process spawning from the web service context. Extended reasoning capabilities enable identification of obfuscated injection attempts and correlation with known Ruijie exploitation signatures, surfacing both direct attack indicators and behavioral anomalies that precede command execution.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-12197.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-12197

Casky has 419 skills that investigate the attack patterns behind CVE-2026-12197. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn