---
id: "CVE-2026-120241"
kind: "vulnerability"
aliases: ["CVE-2026-120241"]
title: "Ruijie switches: buffer overflow in firmware upgrade interface allows remote attack"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "RG-ES205GC", "fixed": [], "affected": "ESW_1.0(1)B1P48", "ecosystem": "vendor"}, {"name": "RG-ES206GC-P", "fixed": [], "affected": "ESW_1.0(1)B1P48", "ecosystem": "vendor"}, {"name": "RG-ES208GC", "fixed": [], "affected": "ESW_1.0(1)B1P48", "ecosystem": "vendor"}, {"name": "RG-ES210GC-LP", "fixed": [], "affected": "ESW_1.0(1)B1P48", "ecosystem": "vendor"}, {"name": "RG-ES210GS-P", "fixed": [], "affected": "ESW_1.0(1)B1P48", "ecosystem": "vendor"}]
ecosystems: []
tags: ["firmware", "infrastructure", "network-switch", "no-vendor-fix", "ruijie", "web-management"]
not_affected_if: ["management-interface-isolated", "other-firmware-versions", "other-ruijie-models"]
published_at: "2026-11-01T19:16:59+00:00"
first_seen_at: "2026-11-01T19:21:44+00:00"
updated_at: "2026-11-01T19:24:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120241", "first_seen_at": "2026-11-01T19:21:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-01T19:24:35+00:00"}]
---

# Ruijie switches: buffer overflow in firmware upgrade interface allows remote attack

Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P switches on firmware ESW_1.0(1)B1P48 have a buffer overflow in httpupg.cgi, the local firmware upgrade interface. VulDB says it can be triggered remotely without authentication and that a proof-of-concept is public. Ruijie has not published an advisory or fix, and VulDB says the vendor did not respond.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:RG-ES205GC affected ESW_1.0(1)B1P48 fixed ?
- vendor:RG-ES206GC-P affected ESW_1.0(1)B1P48 fixed ?
- vendor:RG-ES208GC affected ESW_1.0(1)B1P48 fixed ?
- vendor:RG-ES210GC-LP affected ESW_1.0(1)B1P48 fixed ?
- vendor:RG-ES210GS-P affected ESW_1.0(1)B1P48 fixed ?

## How to check

- Log in to each Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP or RG-ES210GS-P switch and read the firmware version; ESW_1.0(1)B1P48 is the reported vulnerable build (VulDB: Release(12211919)). Other builds are not confirmed either way.
- Check whether the switch web management interface (eWeb) is reachable from untrusted networks or the internet.
- Also check if you run other ESW-firmware Ruijie models such as the RG-NIS2100 series: the submitter says they may be affected, which is unconfirmed.

## Timeline

- 2026-11-01T19:21:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120241
- 2026-11-01T19:24:35+00:00 analyst — No Ruijie advisory yet (PSIRT index checked 2026-11-01); VulDB says vendor never responded, no countermeasure known, PoC on GitHub (not yet reviewed, link not exposed), no auth required. B1P48 is the build Ruijie named as the repair for the July 2025 password bug, so the usual 'update to B1P48' no longer helps. Nothing verified: no primary source. Fix unknown.

## Documents

- [describes] VulDB VDB-429600: Ruijie RG-ES httpupg.cgi buffer overflow https://vuldb.com/vuln/429600
- [mentions] Ruijie PSIRT security bulletins index (no entry for this CVE as of 2026-11-01) https://www.ruijie.com/en-global/support/securityBulletins
- [mentions] Ruijie bulletin RJPSIRT-2025-07090 (earlier RG-ES bug; named B1P48 as repair version) https://www.ruijie.com/en-global/support/securityBulletins/cybersecurity_bulletins/10004

## From the sources

A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. Impacted is an unknown function of the file httpupg.cgi of the component Local Firmware Upgrade Interface. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_