2.4
LowCVSS 3.1 · from VulDB
CVE-2026-120242
Ruijie RG-ES205GC Cloud Management set_cloud_serverUrl.cgi cross site scripting
RG-ES205GC · Cross-site scripting · CWE-79AffectedRG-ES205GC, RG-ES206GC-P, RG-ES208GC and 2 more
FixNo fix listed yet.
PublishedNov 1, 19:00 · VulDB
ScoredNov 1 · 2.4 · VulDB
Exploit code publicNone known · checked 23:18 UTC
ExploitedNone known · CISA KEV checked 23:19 UTC
What we know
No known exploitation. CISA KEV, checked 23:19 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 23:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
Description
A security flaw has been discovered in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. The affected element is an unknown function of the file set_cloud_serverUrl.cgi of the component Cloud Management. The manipulation of the argument url results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
From VulDB
Affected and fixed versions
ProductAffectedFixed inRG-ES205GCESW_1.0(1)B1P48–RG-ES206GC-PESW_1.0(1)B1P48–RG-ES208GCESW_1.0(1)B1P48–RG-ES210GC-LPESW_1.0(1)B1P48–RG-ES210GS-PESW_1.0(1)B1P48–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known