Public vulnerability disclosure
CVE-2026-120241
CVE-2026-120241
publishedCWE-119
A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. Impacted is an unknown function of the file httpupg.cgi of the component Local Firmware Upgrade Interface. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Technical severity7.7 highCVSS 4.0 · NVD: [email protected]
Published2026-11-01Source updated 2026-11-01
Collected2026-11-021 attributed source
Fixes and workarounds
No remediation reported in collected sources.
Missing remediation information is not evidence that no patch exists.
Affected products and versions
No affected-product ranges reported in collected sources.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 7.7 high |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD: [email protected] |
| 3.1 / 7.5 high |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD: [email protected] |
| 2.0 / 7.8 high |
AV:N/AC:L/Au:N/C:N/I:N/A:C | NVD: [email protected] |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://github.com/byseeker/Ruijie-RG-ES-Series-Switches_PreAuth_Boundary_Overflow_DoS[email protected]
- https://vuldb.com/cve/CVE-2026-120241[email protected]
- https://vuldb.com/submit/1016041[email protected]
- https://vuldb.com/vuln/429600[email protected]
- https://vuldb.com/vuln/429600/cti[email protected]