CVE-2026-120242
Received Received - Intake

Cross-Site Scripting in Ruijie ESW Series Switches

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: VulDB

Description
A security flaw has been discovered in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. The affected element is an unknown function of the file set_cloud_serverUrl.cgi of the component Cloud Management. The manipulation of the argument url results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120242

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Ruijie RG-ES205GC ESW_1.0(1)B1P48
Ruijie RG-ES206GC-P ESW_1.0(1)B1P48
Ruijie RG-ES208GC ESW_1.0(1)B1P48
Ruijie RG-ES210GC-LP ESW_1.0(1)B1P48
Ruijie RG-ES210GS-P ESW_1.0(1)B1P48

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in Ruijie RG-ES series network switches running ESW_1.0(1)B1P48 firmware. It exists in the Cloud Management component, specifically in the set_cloud_serverUrl.cgi file. The issue allows attackers to inject malicious scripts via the 'url' parameter, which are then stored and executed when other users access the affected page.

Detection Guidance

To detect this vulnerability, inspect network traffic for requests to the set_cloud_serverUrl.cgi endpoint with a malformed url parameter. Check logs for unusual JavaScript code execution in web interfaces of affected Ruijie switches (RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP, RG-ES210GS-P).

Commands: Use curl to test the endpoint: curl -v 'http://<switch-ip>/set_cloud_serverUrl.cgi?url=<script>alert(1)</script>'. Monitor HTTP responses for reflected or stored XSS payloads.

Impact Analysis

An attacker could exploit this to steal session cookies, redirect users to malicious sites, or perform actions on behalf of users. Since the payload is stored, it affects all users accessing the vulnerable page. The public availability of exploit code increases the risk of real-world attacks.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to sensitive data, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may expose protected health information if healthcare systems use these switches. Both regulations mandate protection against such attacks to ensure data security.

Mitigation Strategies

Immediately update the firmware of affected Ruijie switches to the latest version if available. If no patch exists, restrict access to the set_cloud_serverUrl.cgi endpoint via network segmentation or firewall rules. Disable cloud management features if unused.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120242. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...