CVE-2025-56752 Auth bypass in n/a
Remote attackers can bypass authentication on Ruijie RG-ES switches via crafted HTTP requests to gain administrative control and alter settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-56752?
CVE-2025-56752 is a critical authentication bypass vulnerability in n/a, published on 3 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the Ruijie RG-ES series switch firmware ESW_1.0(1)B1P39 enables remote attackers to fully bypass authentication mechanisms, providing them with unrestricted access to alter administrative settings and potentially seize control of affected devices via crafted HTTP POST request to /user.cgi.
Weakness: CWE-287
Which versions are affected by CVE-2025-56752?
It affects 20 products.
Products include Ruijie Rg-Es205gc-P Firmware, Ruijie Rg-Es205gc Firmware, Ruijie Rg-Es206gc-P Firmware, Ruijie Rg-Es206gs-P Firmware, Ruijie Rg-Es206mg-P Firmware, Ruijie Rg-Es208gc Firmware and 14 more.
How do I fix CVE-2025-56752?
No fix has been published for CVE-2025-56752 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-56752 being exploited?
There is no known exploitation of CVE-2025-56752 in the wild and no public exploit code.
Sources
Also known as GHSA-5m6q-c52m-c8v4.