CVE-2026-120242

LowCVSS 2.4/10Last modified Nov 6, 2026

Description

A security flaw has been discovered in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. The affected element is an unknown function of the file set_cloud_serverUrl.cgi of the component Cloud Management. The manipulation of the argument url results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 2.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
Ruijie	RG-ES205GC	ESW_1.0(1)B1P48
Ruijie	RG-ES206GC-P	ESW_1.0(1)B1P48
Ruijie	RG-ES208GC	ESW_1.0(1)B1P48
Ruijie	RG-ES210GC-LP	ESW_1.0(1)B1P48
Ruijie	RG-ES210GS-P	ESW_1.0(1)B1P48

References

Timeline

Published: Nov 1, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1202435.5FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stac CVE-2026-1202445.5FFmpeg 2.1 through 9.0.2 contains an uninitialized memory disclosure vulnerability in pcx_decode_frame() in libavcodec/pcx.c that leaves sca CVE-2026-1202455.5FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that l CVE-2026-1202465.5FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pix CVE-2026-1202475.5FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap me CVE-2026-1202484.8Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store upd CVE-2026-1202496.5Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations CVE-2026-120255.3Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised CVE-2026-1202505.3OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/email_debug.py CVE-2026-1202515.5imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() that allows attackers to hang th CVE-2026-1202525.5imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table pars CVE-2026-120266.5Out of bounds read in Video in Google Chrome on ChromeOS prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer