Ruijie RG-ES Series Switches httpupg.cgi Buffer Overflow Vulnerability (CVE-2026-120241)
Executive & SecOps Summary
SECOPS ASSESSMENTRuijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP, and RG-ES210GS-P switches running firmware ESW_1.0(1)B1P48
Unauthenticated remote attackers can trigger a buffer overflow via the local firmware upgrade interface (httpupg.cgi), leading to a complete Denial of Service (DoS)
Restrict access to the switch's web management interface using Access Control Lists (ACLs) and isolate management traffic to a dedicated Out-of-Band (OOB) network
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Check the vendor's official support channels for firmware updates addressing this vulnerability. To upgrade the firmware via TFTP on a Ruijie switch, use the following CLI commands as a reference:
# Download and apply the secure firmware image from a local TFTP server
# (Note: Replace the IP and filename with your actual environment details)
copy tftp://192.168.1.100/RG-ES_latest_firmware.bin flash:/RG-ES_latest_firmware.bin
boot system flash:/RG-ES_latest_firmware.bin
reload2. Temporary Workaround & Hardening Configuration
If a patch cannot be immediately applied, restrict access to the web management interface using Access Control Lists (ACLs) to ensure only authorized administrators can access the HTTP/HTTPS services:
# Define an ACL allowing only the trusted management subnet
ip access-list standard MGMT_ACL
permit 192.168.10.0 0.0.0.255
deny any
exit
# Apply the ACL to the HTTP and HTTPS services
ip http access-class MGMT_ACL
ip https access-class MGMT_ACL3. Log Audit & IoC Verification Commands
Monitor network traffic and syslog servers for anomalous POST requests targeting httpupg.cgi. You can search centralized log repositories using the following command:
# Search web server access logs for suspicious requests to the vulnerable CGI script
grep -i 'httpupg.cgi' /var/log/syslog /var/log/nginx/access.log 2>/dev/null
# Verify the current firmware version of the switch via CLI
show versionStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
A buffer overflow vulnerability (CVE-2026-120241) has been identified in the local firmware upgrade interface of Ruijie RG-ES series switches. The vulnerability resides within the httpupg.cgi component of the web management interface. Due to insufficient boundary validation of user-supplied input before copying it into a fixed-size memory buffer, an attacker can trigger a classic buffer overflow condition (CWE-119, CWE-120).
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker with network access to the switch's HTTP/HTTPS management port can send a specially crafted, oversized payload to the httpupg.cgi endpoint. Because the input length is not validated, the payload overwrites adjacent memory spaces on the stack or heap. This corruption crashes the web server daemon or the entire switch operating system, causing a device reboot or a persistent Denial of Service (DoS) state. A public exploit is currently available, increasing the likelihood of active exploitation.
3. Infrastructure & Business Impact
Switches serve as critical infrastructure components. A successful Denial of Service (DoS) attack on these devices disrupts all network traffic passing through the affected switch, disconnecting downstream servers and workstations. This can lead to severe operational downtime, loss of business continuity, and may require physical intervention or manual power cycles to restore services if remote management becomes unresponsive.
Official Vendor Advisories & References
A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. Impacted is an unknown function of the file httpupg.cgi of the component Local Firmware Upgrade Interface. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Frequently Asked SecOps Questions (CVE-2026-120241)
FAQQ1. How critical is CVE-2026-120241 and is it actively exploited in the wild?
CVE-2026-120241 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 0.6%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-120241?
Primary impacted vendors include ruijie across rg-es205gc, rg-es206gc-p, rg-es208gc, rg-es210gc-lp, rg-es210gs-p. Scope summary: Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP, and RG-ES210GS-P switches running firmware ESW_1.0(1)B1P48
Q3. What temporary mitigations or workarounds exist for CVE-2026-120241 before patching?
[Mitigation] Restrict access to the switch's web management interface using Access Control Lists (ACLs) and isolate management traffic to a dedicated Out-of-Band (OOB) network Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-120241
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (ruijie)
View Category →Ruijie RG-ES Series Switches set_cloud_serverUrl.cgi Remote Cross-Site Scripting (XSS) Vulnerability (CVE-2026-120242)
[Affected Scope] Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP, and RG-ES210GS-P switches running firmware ESW_1.0(1)B1P48
Citrix NetScaler ADC and Gateway Memory Overflow Vulnerability (CVE-2026-8452) Critical Security Advisory
[Affected Scope] Citrix NetScaler ADC and NetScaler Gateway appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
Citrix NetScaler ADC and Gateway Remote Code Execution (RCE) and DoS Vulnerability (CVE-2026-88772)
[Affected Scope] Citrix NetScaler ADC and Gateway versions prior to 14.1-73.37 and 13.1-64.23, including FIPS/NDcPP editions.
Security Advisory for NetScaler ADC and Gateway Denial of Service (DoS) Vulnerability (CVE-2026-88779)
[Affected Scope] NetScaler ADC and Gateway versions prior to 14.1-73.41 and 13.1-64.28.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.