CVE-2026-23699

View on CVE.org
Published Jan 22, 2026 CVSS 4.0 · 8.6 High EPSS 1.6% KEV · Not listed
Description
AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. If this vulnerability is exploited, arbitrary commands may be executed on the devices.

Analysis

AI-generated

Technical impact

AP180 series routers running firmware versions prior to a specified build contain an operating system command injection flaw that permits the execution of arbitrary commands. This means an attacker can gain full control of the device, potentially hijacking the wireless access point, exposing network traffic, or using it as a foothold for further attacks. The weakness is classified as input that is improperly validated before being passed to the system shell.

Affected Systems

Affected products include Ruijie Networks’ AP180 series: AP180 with any Japan firmware version, AP180(JP) with firmware V1.xx, AP180-AC with firmware V1.xx, V2.xx or V3.xx, and AP180-PE with firmware V1.xx, V2.xx or V3.xx. All releases before firmware AP_RGOS 11.9(4)B1P8 are vulnerable.

Risk and Exploitability

The base score of 8.6 indicates high severity. The exploitation probability is low, with an EPSS score of 2%, and the vulnerability is not currently listed in CISA’s Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that the most likely attack vector involves remote access via configuration interfaces or management protocols exposed to the network. If an attacker can reach those interfaces, they could inject shell commands using crafted requests, but no public exploit has been disclosed.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the device firmware to AP_RGOS 11.9(4)B1P8 or later.
  • Limit remote management access to trusted IP addresses and/or disable the exposed interfaces when not needed.
  • Enable comprehensive logging on the access point and monitor for unexpected command execution or configuration changes.

Generated by OpenCVE AI on June 18, 2026 at 11:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title OS Command Injection in Ruijie AP180 Series Firmware
Type Values Removed Values Added
Title OS Command Injection in Ruijie AP180 Series Firmware
Type Values Removed Values Added
Title OS Command Injection in Ruijie AP180 Series Allowing Arbitrary Command Execution
Type Values Removed Values Added
Title OS Command Injection in Ruijie AP180 Series Allowing Arbitrary Command Execution
Type Values Removed Values Added
First Time appeared Ruijie
Ruijie ap180
Ruijie ap180-ac
Ruijie ap180-pe
Vendors & Products Ruijie
Ruijie ap180
Ruijie ap180-ac
Ruijie ap180-pe
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. If this vulnerability is exploited, arbitrary commands may be executed on the devices.
Weaknesses CWE-78
References
Metrics cvssV3_0

{'score': 7.2, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
Earlier changes (2)
Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
jpcert
Published
Updated
Jan 22, 2026, 5:39 PM
Reserved
Jan 15, 2026, 1:07 AM

View source JSON

Updated
Jan 22, 2026, 5:39 PM

JSON

Status
Deferred
Published
Jan 22, 2026, 2:15 AM
Modified
Jun 17, 2026, 10:21 AM

View source JSON

No data.

Updated
Jun 18, 2026, 11:30 AM

JSON