Ruijie Managed Switches: Buffer overflow in firmware upgrade interface (CVE-2026-120241)
A vulnerability in the Local Firmware Upgrade Interface of specific Ruijie switches allows for remote buffer overflow.
CVE search metadata
CVE search record: CVE-2026-120241. Severity: high. CVSS: 7.5. KEV: no. Product: RG-ES205GC (ESW_1.0(1)B1P48), RG-ES206GC-P (ESW_1.0(1)B1P48), RG-ES208GC (ESW_1.0(1)B1P48), RG-ES210GC-LP (ESW_1.0(1)B1P48), RG-ES210GS-P (ESW_1.0(1)B1P48). Brief: Ruijie Managed Switches: Buffer overflow in firmware upgrade interface (CVE-2026-120241). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ruijie-buffer-overflow/
Triage facts
Revision 1- Applicability
- RG-ES205GC (ESW_1.0(1)B1P48), RG-ES206GC-P (ESW_1.0(1)B1P48) +3
- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Nov 1, 23:01 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability exists in the httpupg.cgi file within the Local Firmware Upgrade Interface of Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP, and RG-ES210GS-P (version ESW_1.0(1)B1P48). The vulnerability allows for remote buffer overflow. Public exploit code is available. The vendor did not respond to disclosure.