{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23699", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2026-01-15T01:07:48.781Z", "datePublished": "2026-01-22T01:41:22.386Z", "dateUpdated": "2026-01-22T17:39:43.926Z"}, "containers": {"cna": {"affected": [{"vendor": "Ruijie Networks Co., Ltd.", "product": "AP180(JA) V1.xx", "versions": [{"version": "prior to AP_RGOS 11.9(4)B1P8", "status": "affected"}]}, {"vendor": "Ruijie Networks Co., Ltd.", "product": "AP180(JP) V1.xx", "versions": [{"version": "prior to AP_RGOS 11.9(4)B1P8", "status": "affected"}]}, {"vendor": "Ruijie Networks Co., Ltd.", "product": "AP180-AC V1.xx", "versions": [{"version": "prior to AP_RGOS 11.9(4)B1P8", "status": "affected"}]}, {"vendor": "Ruijie Networks Co., Ltd.", "product": "AP180-PE V1.xx", "versions": [{"version": "prior to AP_RGOS 11.9(4)B1P8", "status": "affected"}]}, {"vendor": "Ruijie Networks Co., Ltd.", "product": "AP180(JA) V2.xx", "versions": [{"version": "prior to AP_RGOS 11.9(4)B1P8", "status": "affected"}]}, {"vendor": "Ruijie Networks Co., Ltd.", "product": "AP180-AC V2.xx", "versions": [{"version": "prior to AP_RGOS 11.9(4)B1P8", "status": "affected"}]}, {"vendor": "Ruijie Networks Co., Ltd.", "product": "AP180-PE V2.xx", "versions": [{"version": "prior to AP_RGOS 11.9(4)B1P8", "status": "affected"}]}, {"vendor": "Ruijie Networks Co., Ltd.", "product": "AP180-AC V3.xx", "versions": [{"version": "prior to AP_RGOS 11.9(4)B1P8", "status": "affected"}]}, {"vendor": "Ruijie Networks Co., Ltd.", "product": "AP180-PE V3.xx", "versions": [{"version": "prior to AP_RGOS 11.9(4)B1P8", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. If this vulnerability is exploited, arbitrary commands may be executed on the devices."}], "problemTypes": [{"descriptions": [{"description": "Improper neutralization of special elements used in an OS command ('OS Command Injection')", "lang": "en-US", "cweId": "CWE-78", "type": "CWE"}]}], "references": [{"url": "https://www.ruijie.co.jp/products/rg-ap180-pe_p432111650928590848.html#productDocument"}, {"url": "https://jvn.jp/en/jp/JVN86850670/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-01-22T01:41:22.386Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T17:33:57.826150Z", "id": "CVE-2026-23699", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T17:39:43.926Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23699", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-22T17:33:57.826150Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T17:39:41.179Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Ruijie Networks Co., Ltd.", "product": "AP180(JA) V1.xx", "versions": [{"status": "affected", "version": "prior to AP_RGOS 11.9(4)B1P8"}]}, {"vendor": "Ruijie Networks Co., Ltd.", "product": "AP180(JP) V1.xx", "versions": [{"status": "affected", "version": "prior to AP_RGOS 11.9(4)B1P8"}]}, {"vendor": "Ruijie Networks Co., Ltd.", "product": "AP180-AC V1.xx", "versions": [{"status": "affected", "version": "prior to AP_RGOS 11.9(4)B1P8"}]}, {"vendor": "Ruijie Networks Co., Ltd.", "product": "AP180-PE V1.xx", "versions": [{"status": "affected", "version": "prior to AP_RGOS 11.9(4)B1P8"}]}, {"vendor": "Ruijie Networks Co., Ltd.", "product": "AP180(JA) V2.xx", "versions": [{"status": "affected", "version": "prior to AP_RGOS 11.9(4)B1P8"}]}, {"vendor": "Ruijie Networks Co., Ltd.", "product": "AP180-AC V2.xx", "versions": [{"status": "affected", "version": "prior to AP_RGOS 11.9(4)B1P8"}]}, {"vendor": "Ruijie Networks Co., Ltd.", "product": "AP180-PE V2.xx", "versions": [{"status": "affected", "version": "prior to AP_RGOS 11.9(4)B1P8"}]}, {"vendor": "Ruijie Networks Co., Ltd.", "product": "AP180-AC V3.xx", "versions": [{"status": "affected", "version": "prior to AP_RGOS 11.9(4)B1P8"}]}, {"vendor": "Ruijie Networks Co., Ltd.", "product": "AP180-PE V3.xx", "versions": [{"status": "affected", "version": "prior to AP_RGOS 11.9(4)B1P8"}]}], "references": [{"url": "https://www.ruijie.co.jp/products/rg-ap180-pe_p432111650928590848.html#productDocument"}, {"url": "https://jvn.jp/en/jp/JVN86850670/"}], "descriptions": [{"lang": "en", "value": "AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. If this vulnerability is exploited, arbitrary commands may be executed on the devices."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-78", "description": "Improper neutralization of special elements used in an OS command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-01-22T01:41:22.386Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23699", "state": "PUBLISHED", "dateUpdated": "2026-01-22T17:39:43.926Z", "dateReserved": "2026-01-15T01:07:48.781Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2026-01-22T01:41:22.386Z", "assignerShortName": "jpcert"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. If this vulnerability is exploited, arbitrary commands may be executed on the devices."}, {"lang": "es", "value": "La serie AP180 con versiones de firmware anteriores a AP_RGOS 11.9(4)B1P8 contiene una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo. Si se explota esta vulnerabilidad, se pueden ejecutar comandos arbitrarios en los dispositivos."}], "id": "CVE-2026-23699", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}, "published": "2026-01-22T02:15:52.127", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN86850670/"}, {"source": "vultures@jpcert.or.jp", "url": "https://www.ruijie.co.jp/products/rg-ap180-pe_p432111650928590848.html#productDocument"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "vultures@jpcert.or.jp", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T04:00:25.250389+00:00", "value": {"mitigation_remediation": ["Upgrade the device firmware to AP_RGOS\u00a011.9(4)B1P8 or later.", "Limit remote management access to trusted IP addresses and/or disable the exposed interfaces when not needed.", "Enable comprehensive logging on the access point and monitor for unexpected command execution or configuration changes."], "summary": {"action": "Immediate Patch", "impact": "Remote Command Execution"}, "threat_synthesis": {"affected_systems": "Affected products include Ruijie Networks\u2019 AP180 series: AP180 with any Japan firmware version, AP180(JP) with firmware V1.xx, AP180-AC with firmware V1.xx, V2.xx or V3.xx, and AP180-PE with firmware V1.xx, V2.xx or V3.xx. All releases before firmware AP_RGOS\u00a011.9(4)B1P8 are vulnerable.", "description_and_impact": "Ap180 series routers running firmware versions prior to a specified build contain an operating system command injection flaw that permits the execution of arbitrary commands. This means an attacker can gain full control of the device, potentially hijacking the wireless access point, exposing network traffic, or using it as a foothold for further attacks. The weakness is classified as input that is improperly validated before being passed to the system shell.", "risk_and_exploitability": "The base score of 8.6 indicates high severity. The exploitation probability is very low, with an EPSS score below 1\u202fpercent, and the vulnerability is not currently listed in CISA\u2019s Known Exploited Vulnerabilities catalog. The most likely attack vector is remote access via configuration interfaces or management protocols exposed to the network. If an attacker can reach those interfaces, they could inject shell commands using crafted requests, but no public exploit has been disclosed."}}}}, "created": "2026-01-22T10:07:53.697572+00:00", "title": "OS Command Injection in Ruijie AP180 Series Allowing Arbitrary Command Execution", "updated": "2026-04-18T04:15:05.866121+00:00", "vendors": ["ruijie", "ruijie$PRODUCT$ap180", "ruijie$PRODUCT$ap180-ac", "ruijie$PRODUCT$ap180-pe"]}