This vulnerability affects Ruijie EG105G-P version 2.340. It arises from improper input handling in the nslookup function within the JSON-RPC Diagnose Endpoint (/cgi-bin/luci/api/diagnose). By manipulating the params.target parameter, an attacker can perform command injection remotely, potentially executing arbitrary commands on the device. The vulnerability has a CVSS 4.0 base score of 8.6, indicating high severity. The vendor was notified but has not provided any response or fix. No official patch or mitigation guidance is available at this time. Public exploit code is available, but no known exploitation in the wild has been reported.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device without user interaction, potentially leading to full system compromise. Given the high CVSS score and the nature of command injection, this poses a significant risk to confidentiality, integrity, and availability of the device and network it resides in.

No official patch or remediation is currently available from the vendor. Users should monitor vendor communications for updates. Until a fix is released, restrict access to the affected endpoint and consider network-level controls to limit exposure. Avoid exposing the device management interface to untrusted networks. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.