CVE-2026-120242 Ruijie CVE debrief

Who should care

Defenders responsible for Ruijie devices, particularly those with remote access or management capabilities, should assess their exposure and prioritize verification. This includes reviewing inventory for affected devices, assessing the feasibility of remote attacks, and monitoring for potential exploitation attempts. Security teams and vulnerability management teams should also be aware of the potential impact and take necessary actions to mitigate the风险.

Why it matters

Defenders should prioritize verifying the presence of affected devices in their inventory and assessing the feasibility of remote attacks. The vulnerability has a low CVSS score, but its impact on affected devices requires verification.

• Verify remote attack feasibility
• Assess exposure of affected devices
• Monitor for potential exploitation attempts

Technical summary

A cross-site scripting vulnerability exists in the set_cloud_serverUrl.cgi function of the Cloud Management component in Ruijie devices. The vulnerability is due to improper sanitization of user input in the url argument. This allows remote attackers to inject malicious scripts into the application. The affected products include Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP, and RG-ES210GS-P ESW_1.0(1)B1P48. The vulnerability has a low CVSS score but requires verification of its impact on affected devices.

Defensive priority

Defenders should prioritize verifying the presence of affected devices in their inventory and assessing the feasibility of remote attacks.

Recommended defensive actions

• Verify the presence of affected Ruijie devices in the inventory
• Assess the feasibility of remote attacks on affected devices
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the affected versions, exploitation scope, and remediation. The vulnerability has been publicly disclosed, and defenders should verify the presence of affected Ruijie devices in their inventory. The attack surface and potential impact on affected devices need to be assessed. Limited source information is available, and additional verification tasks are necessary to understand the vulnerability's scope.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.