{"id":"CVE-2026-120241","kind":"vulnerability","aliases":["CVE-2026-120241"],"related":[],"title":"Ruijie switches: buffer overflow in firmware upgrade interface allows remote attack","description":"A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. Impacted is an unknown function of the file httpupg.cgi of the component Local Firmware Upgrade Interface. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P switches on firmware ESW_1.0(1)B1P48 have a buffer overflow in httpupg.cgi, the local firmware upgrade interface. VulDB says it can be triggered remotely without authentication and that a proof-of-concept is public. Ruijie has not published an advisory or fix, and VulDB says the vendor did not respond.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"RG-ES205GC","fixed":[],"affected":"ESW_1.0(1)B1P48","ecosystem":"vendor"},{"name":"RG-ES206GC-P","fixed":[],"affected":"ESW_1.0(1)B1P48","ecosystem":"vendor"},{"name":"RG-ES208GC","fixed":[],"affected":"ESW_1.0(1)B1P48","ecosystem":"vendor"},{"name":"RG-ES210GC-LP","fixed":[],"affected":"ESW_1.0(1)B1P48","ecosystem":"vendor"},{"name":"RG-ES210GS-P","fixed":[],"affected":"ESW_1.0(1)B1P48","ecosystem":"vendor"}],"ecosystems":[],"tags":["firmware","infrastructure","network-switch","no-vendor-fix","ruijie","web-management"],"not_affected_if":["management-interface-isolated","other-firmware-versions","other-ruijie-models"],"how_to_check":"- Log in to each Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP or RG-ES210GS-P switch and read the firmware version; ESW_1.0(1)B1P48 is the reported vulnerable build (VulDB: Release(12211919)). Other builds are not confirmed either way.\n- Check whether the switch web management interface (eWeb) is reachable from untrusted networks or the internet.\n- Also check if you run other ESW-firmware Ruijie models such as the RG-NIS2100 series: the submitter says they may be affected, which is unconfirmed.","fix":null,"status":"open","published_at":"2026-11-01T19:16:59+00:00","first_seen_at":"2026-11-01T19:21:44+00:00","triaged_at":"2026-11-01T19:23:46+00:00","updated_at":"2026-11-01T19:24:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-01T19:23:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Ruijie switches: buffer overflow in firmware upgrade interface allows remote attack","impact":"high","summary":"Several Ruijie RG-ES series network switches have a buffer overflow in the httpupg.cgi local firmware upgrade interface. A remote attacker can trigger it, and a public exploit exists, so the switch may be taken over.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ruijie","network-switch","firmware","web-management"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker may run code on the switch remotely","analyst_note":"Confirm affected firmware range, fix availability and whether authentication is required for httpupg.cgi, using the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-120241 and the vendor advisory if one exists.","how_to_check":"- Check the firmware version on each Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP or RG-ES210GS-P switch against `ESW_1.0(1)B1P48`\n- Check whether the switch web management interface is reachable from untrusted networks\n- unknown for any other check, as the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["other-ruijie-models","management-interface-isolated"],"who_is_affected":"Organisations running the listed Ruijie RG-ES switch models with the web management interface reachable over the network are exposed. The sources do not say whether the vulnerable firmware is the only affected version or whether any setting limits exposure. Teams with these switches isolated from untrusted networks have less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4242,"output_tokens":650,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected firmware range, fix availability and whether authentication is required for httpupg.cgi, using the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-120241 and the vendor advisory if one exists.","search":"'-120241':14A,17A '-2026':13A,16A '1':74B,148C '1.0':73B,147C 'advisori':110B 'allow':9A 'attack':11A,178C 'authent':95B 'avail':184C 'b1p48':75B,149C 'buffer':3A,78B,170C 'compon':161C 'concept':102B 'contact':192C 'cve':12A,15A 'disclosur':196C 'earli':193C 'es205gc':20A,52B,129C 'es206gc':23A,55B,132C 'es208gc':27A,59B,136C 'es210gc':30A,62B,139C 'es210gs':34A,67B,144C 'esw':72B,146C 'exploit':181C 'file':157C 'firmwar':6A,36B,71B,84B,163C 'fix':44B,112B 'function':154C 'httpupg.cgi':81B,158C 'identifi':124C 'impact':150C 'infrastructur':37B 'initi':176C 'interfac':8A,86B,165C 'lead':168C 'local':83B,162C 'lp':31A,63B,140C 'manag':48B 'manipul':167C 'might':186C 'network':39B 'network-switch':38B 'no-vendor-fix':41B 'overflow':4A,79B,171C 'p':24A,35A,56B,68B,133C,145C 'possibl':174C 'proof':100B 'proof-of-concept':99B 'public':104B,183C 'publish':108B 'remot':10A,93B,179C 'respond':120B,200C 'rg':19A,22A,26A,29A,33A,51B,54B,58B,61B,66B,128C,131C,135C,138C,143C 'rg-es205gc':18A,50B,127C 'rg-es206gc-p':21A,53B,130C 'rg-es208gc':25A,57B,134C 'rg-es210gc-lp':28A,60B,137C 'rg-es210gs-p':32A,65B,142C 'ruiji':1A,45B,49B,105B,126C 'say':88B,115B 'switch':2A,40B,69B 'trigger':92B 'unknown':153C 'upgrad':7A,85B,164C 'use':188C 'vendor':43B,117B,190C 'vuldb':87B,114B 'vulner':122C 'way':203C 'web':47B 'web-manag':46B 'without':94B","nicknames":[],"mitigations":[],"who_affected":"Teams running the five listed Ruijie RG-ES switch models on firmware ESW_1.0(1)B1P48 are exposed if the web management interface can be reached by an attacker. VulDB reports no authentication is needed. Switches whose management interface is only reachable from an isolated management network are much less exposed. Other Ruijie models are not confirmed affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T19:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120241","severity":null,"published_at":"2026-11-01T19:16:59+00:00","modified_at":"2026-11-01T19:16:59+00:00","first_seen_at":"2026-11-01T19:21:44+00:00","fetched_at":"2026-11-01T19:21:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120241:1318","url":null,"severity":null,"published_at":"2026-11-01T19:24:35+00:00","modified_at":"2026-11-01T19:24:35+00:00","first_seen_at":"2026-11-01T19:24:35+00:00","fetched_at":"2026-11-01T19:24:35+00:00","note":"No Ruijie advisory yet (PSIRT index checked 2026-11-01); VulDB says vendor never responded, no countermeasure known, PoC on GitHub (not yet reviewed, link not exposed), no auth required. B1P48 is the build Ruijie named as the repair for the July 2025 password bug, so the usual 'update to B1P48' no longer helps. Nothing verified: no primary source. Fix unknown."}],"documents":[{"id":40405,"url":"https://vuldb.com/vuln/429600","title":"VulDB VDB-429600: Ruijie RG-ES httpupg.cgi buffer overflow","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":40406,"url":"https://www.ruijie.com/en-global/support/securityBulletins","title":"Ruijie PSIRT security bulletins index (no entry for this CVE as of 2026-11-01)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":40407,"url":"https://www.ruijie.com/en-global/support/securityBulletins/cybersecurity_bulletins/10004","title":"Ruijie bulletin RJPSIRT-2025-07090 (earlier RG-ES bug; named B1P48 as repair version)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}