# CVE-2026-120241: CVE-2026-120241

Status: published. Published: 2026-11-01. Updated: 2026-11-01.

A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. Impacted is an unknown function of the file httpupg.cgi of the component Local Firmware Upgrade Interface. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

No remediation reported in collected sources

## Affected products and versions

Not reported in collected sources.

## Severity and prioritization

- CVSS 4.0: 7.7 (high); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: cna@vuldb.com

- CVSS 3.1: 7.5 (high); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; source: NVD: cna@vuldb.com

- CVSS 2.0: 7.8 (high); AV:N/AC:L/Au:N/C:N/I:N/A:C; source: NVD: cna@vuldb.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-119

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/byseeker/Ruijie-RG-ES-Series-Switches_PreAuth_Boundary_Overflow_DoS (cna@vuldb.com)

- https://vuldb.com/cve/CVE-2026-120241 (cna@vuldb.com)

- https://vuldb.com/submit/1016041 (cna@vuldb.com)

- https://vuldb.com/vuln/429600 (cna@vuldb.com)

- https://vuldb.com/vuln/429600/cti (cna@vuldb.com)

## Provenance

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-120241; retrieved 2026-11-02; source updated 2026-11-01

Revision: 2bbbdce0d013bdc39621bec24bbeea9053b374f2268ea2b56bb5847e2a88a3d2

Canonical: https://y2.dev/cve/CVE-2026-120241