Legion_Tl

A vulnerability has been found in Ruijie RG-EW3000GX EW 3.0(1)B11P380. Affected by this vulnerability is the function cc set of the file unifyframe-sgi.elf of the component configChange. Such manipulation of the argument data.url leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

A vulnerability was found in Ruijie RG-EW3000GX EW 3.0(1)B11P380. Affected by this issue is some unknown functionality of the file /etc/rg config/admin of the component user list note Module. Performing a manipulation of the argument Name results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

**Name of the Vulnerable Software and Affected Versions** D-Link R95 BE9500 version 1.00.16 **Description** An OS command injection flaw exists in the DHMAPI component of the device. The issue occurs when the `NTPServer` argument is processed by the `system()` function within the `/bin/ssi` file. Because the input is passed to a shell command interpreter without sufficient sanitization, a remote attacker can inject and execute arbitrary operating system commands as root. This action can be performed without authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `NTPServer` parameter in the affected component to minimize the risk of exploitation.