CVE-2026-120241
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P devices (version ESW_1.0(1)B1P48) in an unknown function of httpupg.cgi, part of the local firmware upgrade interface. The manipulation leads to a buffer overflow. The attack can be initiated remotely and the exploit is publicly available.
Risk Assessment
A remote attacker could exploit the buffer overflow to destabilize the device or potentially achieve code execution. The public availability of the exploit increases the risk of attack.
Recommendation
Restrict access to the firmware upgrade interface and apply the vendor patch as soon as it becomes available. Until then, monitor network traffic and isolate vulnerable devices.
Other vulnerabilities in Ruijie RG-ES205GC/ES206GC-P/ES208GC/ES210GC-LP/ES210GS-P
Original NVD description (English source)
A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. Impacted is an unknown function of the file httpupg.cgi of the component Local Firmware Upgrade Interface. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS