Description
AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. If this vulnerability is exploited, arbitrary commands may be executed on the devices.
Published: 2026-01-22
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

Ap180 series routers running firmware versions prior to a specified build contain an operating system command injection flaw that permits the execution of arbitrary commands. This means an attacker can gain full control of the device, potentially hijacking the wireless access point, exposing network traffic, or using it as a foothold for further attacks. The weakness is classified as input that is improperly validated before being passed to the system shell.

Affected Systems

Affected products include Ruijie Networks’ AP180 series: AP180 with any Japan firmware version, AP180(JP) with firmware V1.xx, AP180-AC with firmware V1.xx, V2.xx or V3.xx, and AP180-PE with firmware V1.xx, V2.xx or V3.xx. All releases before firmware AP_RGOS 11.9(4)B1P8 are vulnerable.

Risk and Exploitability

The base score of 8.6 indicates high severity. The exploitation probability is very low, with an EPSS score below 1 percent, and the vulnerability is not currently listed in CISA’s Known Exploited Vulnerabilities catalog. The most likely attack vector is remote access via configuration interfaces or management protocols exposed to the network. If an attacker can reach those interfaces, they could inject shell commands using crafted requests, but no public exploit has been disclosed.

Generated by OpenCVE AI on April 18, 2026 at 04:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the device firmware to AP_RGOS 11.9(4)B1P8 or later.
  • Limit remote management access to trusted IP addresses and/or disable the exposed interfaces when not needed.
  • Enable comprehensive logging on the access point and monitor for unexpected command execution or configuration changes.

Generated by OpenCVE AI on April 18, 2026 at 04:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 18 Apr 2026 04:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Ruijie AP180 Series Allowing Arbitrary Command Execution

Fri, 23 Jan 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Ruijie
Ruijie ap180
Ruijie ap180-ac
Ruijie ap180-pe
Vendors & Products Ruijie
Ruijie ap180
Ruijie ap180-ac
Ruijie ap180-pe

Thu, 22 Jan 2026 23:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 22 Jan 2026 02:00:00 +0000

Type Values Removed Values Added
Description AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. If this vulnerability is exploited, arbitrary commands may be executed on the devices.
Weaknesses CWE-78
References
Metrics cvssV3_0

{'score': 7.2, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Ruijie Ap180 Ap180-ac Ap180-pe
cve-icon MITRE

Status: PUBLISHED

Assigner: jpcert

Published:

Updated: 2026-01-22T17:39:43.926Z

Reserved: 2026-01-15T01:07:48.781Z

Link: CVE-2026-23699

cve-icon Vulnrichment

Updated: 2026-01-22T17:39:41.179Z

cve-icon NVD

Status : Deferred

Published: 2026-01-22T02:15:52.127

Modified: 2026-04-15T00:35:42.020

Link: CVE-2026-23699

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T04:15:05Z

Weaknesses