Ruijie RG-ES Switches CVE-2026-120241

Exploitation requires network reachability to the switch's Local Firmware Upgrade web interface (the httpupg.cgi endpoint); no authentication, credentials, or user interaction are needed (PR:N/UI:N), and default-reachable management interfaces are sufficient. The primary limiting factor is exposure of the management plane: these are small Ethernet switches whose web management is typically intended for a trusted LAN/management VLAN, so realistic risk is concentrated where the interface is reachable from untrusted networks or the internet. The confirmed effect is denial of service (device crash) rather than code execution, which bounds the impact regardless of the buffer-overflow class.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, pre-authentication flaw, but the impact metrics are limited to availability (VC:N/VI:N/VA:H) - meaning the confirmed consequence is denial of service (device crash/reboot), NOT confirmed code execution or data compromise, even though the bug class is CWE-120 buffer overflow. This is consistent with the exploit reference title, which explicitly describes a 'PreAuth Boundary Overflow DoS.' The E:P flag (Proof-of-Concept) and the GitHub reference indicate a public PoC reference exists; it is not verified as working exploit code. There is no CISA KEV entry and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation - absence of these signals is not proof of safety but does weigh against emergency urgency. The vuln.today decision label is 'this_week,' not act_now/emergency, which aligns with a pre-auth remote DoS on niche hardware rather than a mass-exploited RCE. A notable escalation factor is that the vendor was contacted but did not respond, so no official fix or mitigation is confirmed. Net: a genuine but availability-only (DoS) issue on network switches - prioritize for internet-exposed or untrusted-network-facing management planes, but it is not a high-CVSS-but-no-real-mechanism phantom, nor a confirmed RCE.

An attacker with network access to a switch's web-based Local Firmware Upgrade interface sends a crafted request to httpupg.cgi that overflows a buffer, crashing the device and interrupting the network segment it serves. No authentication or user interaction is required (PR:N/UI:N). A public PoC reference exists but is not verified as working exploit code, and the demonstrated impact is denial of service rather than code execution.