Cross-Site Scripting Vulnerability in Ruijie Cloud Management Products
CVE-2026-120242

4.8MEDIUM

Key Information:

Vendor: Ruijie
Status: Rg-es205gc; Rg-es206gc-p; Rg-es208gc; Rg-es210gc-lp
Vendor: CVE Published:; 1 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-120242?

A security vulnerability has been identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP, and RG-ES210GS-P devices, specifically within the Cloud Management component. The flaw arises due to improper handling of the 'url' argument in the file set_cloud_serverUrl.cgi. This vulnerability allows an attacker to execute cross-site scripting attacks remotely, potentially compromising sensitive user data. Publicly available exploits signify an immediate need for mitigation, as the vendor has yet to respond to this critical information.

Affected Version(s)

RG-ES205GC ESW_1.0(1)B1P48

RG-ES206GC-P ESW_1.0(1)B1P48

RG-ES208GC ESW_1.0(1)B1P48

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-120242 - Proof of Concept