External risk intelligence

Ruijie RG-ES Series Switches Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2025-56752

The vulnerability affects administrative interfaces of network switches. While these devices are typically managed within internal or management networks, they are occasionally exposed to the internet or reachable via gateway/management portals in specific deployments. It is plausible for these interfaces to be internet-reachable, but they are not inherently designed as public-facing services.

Authentication Bypass

Ruijie Rg Es228gs P Firmware

esw_1.0\(1\)b1p27esw_1.0\(1\)b1p35esw_1.0\(1\)b1p39esw_1.0\(1\)b1p42_release\(12142711\)

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Ruijie RG-ES series network switch firmware, allowing unauthenticated remote attackers to bypass security controls and gain administrative access to devices. This could lead to unauthorized changes to network settings and potential device takeover.

Unauthenticated remote access to switch settings.
Affects critical network infrastructure components.
Confirm relevance to ensure network integrity.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component over the network by sending a specially crafted HTTP POST request to the `/user.cgi` endpoint. This bypasses authentication, allowing them to modify administrative settings and potentially take full control of the device.

Network access is required.
A crafted HTTP POST request triggers the vulnerability.
Unrestricted administrative access is the primary risk.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, remote attackers can bypass authentication on Ruijie RG-ES series switches to alter administrative settings and gain control of devices. This could lead to unauthorized configuration changes or device takeover.

Device administrative settings.
Via crafted HTTP POST request.
Unauthorized control of devices.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Ruijie RG-ES series switch firmware allows for complete authentication bypass, potentially leading to full device control. Infrastructure and network operations teams are likely responsible for managing these switches. The immediate first step is to identify all instances of the affected firmware, determine their network exposure and criticality, and then locate the accountable asset owner for remediation planning.

Network and infrastructure teams own this.
Verify device exposure and criticality.
Plan remediation during a maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Ruijie RG-ES series switch?

The Ruijie RG-ES series refers to a family of network switches—such as the RG-ES228GS-P, RG-ES209GC-P, and others—that use the affected firmware. These devices act as foundational hardware for managing local network traffic, connecting devices like computers, printers, and access points to the larger network infrastructure.

What does CVE-2025-56752 mean for security?

This vulnerability is an authentication bypass, classified under CWE-287. It means the security mechanism designed to verify a user's identity before granting administrative access is effectively broken. Consequently, an attacker does not need to provide a valid username or password to perform unauthorized actions on the switch.

How is this vulnerability triggered?

An attacker triggers this bug by sending a specifically formatted HTTP POST request to the '/user.cgi' file on the switch. It requires network connectivity to the device's management interface. If the interface is unreachable or if the request is not properly crafted to target this endpoint, the bypass will not occur.

Is my device at risk?

According to Halo Surface Signal, these switches are generally managed within internal or private network segments and are not designed to be public-facing. However, they may be at risk if the administrative interface is accessible via the internet or through an exposed management gateway. You should evaluate if your specific deployment makes these interfaces reachable from outside your trusted network.

What steps should I take if I use these switches?

First, inventory your network to identify all running Ruijie RG-ES devices and check their firmware versions against the advisory list. Once identified, assess their network reachability to determine which are most exposed. Finally, coordinate with your network or infrastructure team to plan and apply the necessary updates or security hardening during a scheduled maintenance window.

References

github.com/TNCX-byte/Vulnerability_Research/blob/main/CVE-2025-5…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.