RCE in Ruijie Networks Co., Ltd. Ap180-Ac V1.xx
CVE-2026-23699
AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. If this vulnerability is exploited, arbitrary commands may be executed on the devices.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.016 (74.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 75th percentile — 74.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.016 · change: +0.001
Affected products
- Ruijie Networks Co., Ltd. Ap180-Ac V1.xx — versions prior to AP_RGOS 11.9(4)B1P8
- Ruijie Networks Co., Ltd. Ap180-Ac V2.xx — versions prior to AP_RGOS 11.9(4)B1P8
- Ruijie Networks Co., Ltd. Ap180-Ac V3.xx — versions prior to AP_RGOS 11.9(4)B1P8
- Ruijie Networks Co., Ltd. Ap180(ja) V1.xx — versions prior to AP_RGOS 11.9(4)B1P8
- Ruijie Networks Co., Ltd. Ap180(ja) V2.xx — versions prior to AP_RGOS 11.9(4)B1P8
- Ruijie Networks Co., Ltd. Ap180(jp) V1.xx — versions prior to AP_RGOS 11.9(4)B1P8
- Ruijie Networks Co., Ltd. Ap180-Pe V1.xx — versions prior to AP_RGOS 11.9(4)B1P8
- Ruijie Networks Co., Ltd. Ap180-Pe V2.xx — versions prior to AP_RGOS 11.9(4)B1P8
- Ruijie Networks Co., Ltd. Ap180-Pe V3.xx — versions prior to AP_RGOS 11.9(4)B1P8
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-23699?
- CVE-2026-23699 is a high-severity vulnerability in Ruijie Networks Co., Ltd. Ap180-Ac V1.xx, classified under OS Command Injection. CVSS score: 7.2/10. Published 2026-01-22.
- How severe is CVE-2026-23699?
- High severity. CVSS v3 base score is 7.2 out of 10.