# CVE-2026-120242: CVE-2026-120242

Status: published. Published: 2026-11-01. Updated: 2026-11-01.

A security flaw has been discovered in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. The affected element is an unknown function of the file set_cloud_serverUrl.cgi of the component Cloud Management. The manipulation of the argument url results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

No remediation reported in collected sources

## Affected products and versions

Not reported in collected sources.

## Severity and prioritization

- CVSS 4.0: 1.9 (low); CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: cna@vuldb.com

- CVSS 3.1: 2.4 (low); CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N; source: NVD: cna@vuldb.com

- CVSS 2.0: 3.3 (low); AV:N/AC:L/Au:M/C:N/I:P/A:N; source: NVD: cna@vuldb.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-79

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/byseeker/Ruijie-RG-ES-Series-Switches_XSS (cna@vuldb.com)

- https://vuldb.com/cve/CVE-2026-120242 (cna@vuldb.com)

- https://vuldb.com/submit/1016042 (cna@vuldb.com)

- https://vuldb.com/vuln/429601 (cna@vuldb.com)

- https://vuldb.com/vuln/429601/cti (cna@vuldb.com)

## Provenance

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-120242; retrieved 2026-11-02; source updated 2026-11-01

Revision: 7241d7c5ebeae8266d3fdb4268a1ddfc429580fcf68078aacfd69e73d3b3a4ab

Canonical: https://y2.dev/cve/CVE-2026-120242