RCE in Ruijie Networks Co., Ltd. Ap180-Ac V1.xx
CVE-2026-23699
AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. If this vulnerability is exploited, arbitrary commands may be executed on the devices.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.015 (72.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Ruijie Networks Co., Ltd. Ap180-ac V1.xx — versions prior to AP_RGOS 11.9(4)B1P8
- Ruijie Networks Co., Ltd. Ap180-ac V2.xx — versions prior to AP_RGOS 11.9(4)B1P8
- Ruijie Networks Co., Ltd. Ap180-ac V3.xx — versions prior to AP_RGOS 11.9(4)B1P8
- Ruijie Networks Co., Ltd. Ap180(ja) V1.xx — versions prior to AP_RGOS 11.9(4)B1P8
- Ruijie Networks Co., Ltd. Ap180(ja) V2.xx — versions prior to AP_RGOS 11.9(4)B1P8
- Ruijie Networks Co., Ltd. Ap180(jp) V1.xx — versions prior to AP_RGOS 11.9(4)B1P8
- Ruijie Networks Co., Ltd. Ap180-pe V1.xx — versions prior to AP_RGOS 11.9(4)B1P8
- Ruijie Networks Co., Ltd. Ap180-pe V2.xx — versions prior to AP_RGOS 11.9(4)B1P8
- Ruijie Networks Co., Ltd. Ap180-pe V3.xx — versions prior to AP_RGOS 11.9(4)B1P8
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-23699?
- CVE-2026-23699 is a high-severity vulnerability in Ruijie Networks Co., Ltd. Ap180-Ac V1.xx, classified under OS Command Injection. CVSS score: 7.2/10. Published 2026-01-22.
- How severe is CVE-2026-23699?
- High severity. CVSS v3 base score is 7.2 out of 10.