Ruijie RG-ES Switches EUVD-2026-114884

Exploitation requires authenticated high-privilege (administrative) access to the device's Cloud Management interface in order to manipulate the 'url' argument of set_cloud_serverUrl.cgi (PR:H), and additionally requires a victim to interact with the resulting page (UI:P) for the injected script to execute. This affects the listed Ruijie models (RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP, RG-ES210GS-P) on firmware ESW_1.0(1)B1P48. The requirement for existing admin credentials is the primary limiting factor and substantially narrows realistic exploitation; no fixed version or vendor mitigation is available because the vendor did not respond to the disclosure.

This is a genuinely low-priority issue, and the signals are consistent in saying so. The vendor CVSS 4.0 base score is 1.9, driven by PR:H (attacker must already hold high-privilege/administrative access to the device), UI:P (a victim must interact), and an impact limited to VI:L (low integrity) with no confidentiality or availability impact (VC:N/VA:N). The vuln.today decision label is 'monitor' - not act_now or emergency - which matches the low score. It is NOT in CISA KEV (no active-exploitation signal), and no EPSS probability was supplied, so there is no quantitative widespread-exploitation estimate to weigh. A public PoC reference exists on GitHub but the input marks it as 'reference only, not verified as working exploit code,' so it should not be treated as a confirmed weaponized exploit. The dominant mitigating factor is PR:H: because exploitation requires existing administrative access to the Cloud Management interface, the realistic additional risk over an already-compromised admin is small. The main caveat is source breadth - this is sourced from a single reporter (VulDB) with no vendor corroboration, so affected-version and impact details are not independently confirmed.

An attacker who already has high-privilege access to the device's Cloud Management interface submits a crafted value in the 'url' argument of set_cloud_serverUrl.cgi, injecting script that is later rendered in an administrative page. When another operator views the affected page, the script executes in their browser session. A public PoC reference exists but is not verified as working exploit code.