High severity8.8NVD Advisory· Published Aug 17, 2023· Updated Jun 17, 2026

CVE-2023-38902

Description

A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITCH_3.0(1)B11P219, RG-EG series business VPN routers v.EG_3.0(1)B11P219, EAP and RAP series wireless access points v.AP_3.0(1)B11P219, and NBC series wireless controllers v.AC_3.0(1)B11P219 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /cgi-bin/luci/api/cmd via the remoteIp field.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

RG/EW series home routers and repeatersdescription
RG EW/RG-EW series home routers and repeatersllm-create
Range: = EW_3.0(1)B11P219
RG NBS/RG-NBS and RG-S1930 series switchesllm-create
Range: = SWITCH_3.0(1)B11P219
RG EG/RG-EG series business VPN routersllm-create
Range: = EG_3.0(1)B11P219
EAP/EAP and RAP series wireless access pointsllm-create
Range: = AP_3.0(1)B11P219
NBC/NBC series wireless controllersllm-create
Range: = AC_3.0(1)B11P219

Patches

Vulnerability mechanics

References

gist.github.com/ZIKH26/18693c67ee7d2f8d2c60231b19194c37nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000