This vulnerability affects the Ruijie RG-EW3000GX EW_3.0(1)B11P380 version. The cc_set function in the unifyframe-sgi.elf file within the configChange component improperly handles the argument data.url, leading to OS command injection. The attack vector is remote, and the exploit code has been publicly disclosed. The CVSS 4.0 score is 9.4, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements. No patch or remediation information is provided in the data.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the system's confidentiality, integrity, and availability. Given the critical CVSS score and the nature of OS command injection, this vulnerability poses a severe risk to affected devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device and monitor for suspicious activity related to the vulnerable function. Avoid exposing the device to untrusted networks.