Ruijie RG-ES Series Switches set_cloud_serverUrl.cgi Remote Cross-Site Scripting (XSS) Vulnerability (CVE-2026-120242)
Executive & SecOps Summary
SECOPS ASSESSMENTRuijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP, and RG-ES210GS-P switches running firmware ESW_1.0(1)B1P48
High-privileged remote attackers can inject malicious scripts via the 'url' parameter in the Cloud Management component, potentially leading to session hijacking of other administrators
Restrict access to the web management interface using ACLs and monitor administrative input parameters for anomalous script payloads
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
As the vendor has not yet provided an official patch or response, administrators must closely monitor Ruijie's official support channels for firmware updates. Once a patch is released, apply it via the CLI as follows:
# Example: Upgrading firmware via TFTP server
enable
copy tftp://192.168.1.100/RG-ES_secure_firmware.bin flash:
boot system flash:RG-ES_secure_firmware.bin
write
reload2. Temporary Workaround & Hardening Configuration
To mitigate the risk immediately, restrict access to the web management interface using Access Control Lists (ACLs) so that only trusted administrative subnets can access the device.
# Restricting Web Management Access via ACL
configure terminal
ip access-list standard MGMT_ACL
permit 192.168.10.0 0.0.0.255
deny any
exit
# Apply ACL to the web server (commands may vary by model)
web-server access-group MGMT_ACL
write memory3. Log Audit & IoC Verification Commands
Inspect the switch logs and web server access logs for suspicious requests targeting set_cloud_serverUrl.cgi containing script tags or event handlers.
# Check switch system logs\show log
show web-server status
# Example: Searching for XSS payloads in forwarded syslog files
grep -Ei 'set_cloud_serverUrl.cgi.*url=.*(<script|javascript:|onerror|onload)' /var/log/syslog_ruijie.logStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
A security vulnerability (CVE-2026-120242) has been identified in the Cloud Management component of Ruijie RG-ES series switches, specifically within the set_cloud_serverUrl.cgi file. The root cause is the lack of sufficient input validation and output sanitization on the url parameter. This allows an attacker to inject arbitrary web scripts or HTML, leading to Cross-Site Scripting (CWE-79) and potential Code Injection (CWE-94).
2. Exploitation Mechanics & Attack Scenario
An attacker with high privileges (PR:H) can manipulate the url argument when calling the set_cloud_serverUrl.cgi endpoint. Because the input is stored or reflected without proper encoding, any subsequent administrator accessing the cloud configuration page will execute the malicious payload within their browser context. This can be leveraged to steal session tokens, perform unauthorized configuration changes, or conduct further lateral movement. Public exploits for this vulnerability have already been released.
3. Infrastructure & Business Impact
Compromising network infrastructure devices like switches poses a severe risk to the entire local network segment. Although the vulnerability requires high privileges to execute, insider threats or compromised administrative sessions can exploit this flaw to disrupt network operations, alter VLAN configurations, or redirect traffic. The vendor has not responded to the initial disclosure, increasing the risk of active exploitation.
Official Vendor Advisories & References
A security flaw has been discovered in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. The affected element is an unknown function of the file set_cloud_serverUrl.cgi of the component Cloud Management. The manipulation of the argument url results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Frequently Asked SecOps Questions (CVE-2026-120242)
FAQQ1. How critical is CVE-2026-120242 and is it actively exploited in the wild?
CVE-2026-120242 is rated CVSS 2.4 (LOW) with a 30-day EPSS exploitation probability of 0.2%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-120242?
Primary impacted vendors include ruijie across rg-es205gc, rg-es206gc-p, rg-es208gc, rg-es210gc-lp, rg-es210gs-p. Scope summary: Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP, and RG-ES210GS-P switches running firmware ESW_1.0(1)B1P48
Q3. What temporary mitigations or workarounds exist for CVE-2026-120242 before patching?
[Mitigation] Restrict access to the web management interface using ACLs and monitor administrative input parameters for anomalous script payloads Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-120242
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (ruijie)
View Category →Ruijie RG-ES Series Switches httpupg.cgi Buffer Overflow Vulnerability (CVE-2026-120241)
[Affected Scope] Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP, and RG-ES210GS-P switches running firmware ESW_1.0(1)B1P48
TrueConf Server Remote Code Execution and Sandbox Escape Vulnerability Advisory (CVE-2026-72530)
[Affected Scope] TrueConf Server versions 5.3.0 to 5.3.9, 5.4.0 to 5.4.9, 5.5.0 to 5.5.5, and earlier
Palo Alto Networks PAN-OS Management Interface Remote Code Execution (RCE) Vulnerability (CVE-2026-0322)
[Affected Scope] Management interfaces of PA-Series, VM-Series firewalls, and Panorama (Virtual and M-Series) running PAN-OS
SonicWall SMA1000 Appliance Management Console (AMC) Remote Code Execution and OS Command Injection (CVE-2026-15410)
[Affected Scope] SonicWall SMA1000 appliances utilizing the Appliance Management Console (AMC)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.