{"id":"CVE-2025-68459","state":"PUBLISHED","title":"RG - AP180, Indoor Wall Plate Wireless AP AP180 series provided by Ruijie Networks Co., Ltd. contain an OS command injection vulnerability. An arbitrary OS command may be executed ","description":"RG - AP180, Indoor Wall Plate Wireless AP AP180 series provided by Ruijie Networks Co., Ltd. contain an OS command injection vulnerability. An arbitrary OS command may be executed on the product by an attacker who logs in to the CLI service.","publishedAt":"2025-12-18T05:51:07.988Z","updatedAt":"2025-12-18T15:33:43.033Z","severity":{"score":8.6,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"jpcert"},"assigner":"jpcert","products":["Ruijie Networks Co., Ltd. AP180-PE V3.xx","Ruijie Networks Co., Ltd. AP180(JA) V1.xx","Ruijie Networks Co., Ltd. AP180(JP) V1.xx","Ruijie Networks Co., Ltd. AP180-AC V1.xx","Ruijie Networks Co., Ltd. AP180-PE V1.xx","Ruijie Networks Co., Ltd. AP180(JA) V2.xx","Ruijie Networks Co., Ltd. AP180-AC V2.xx","Ruijie Networks Co., Ltd. AP180-PE V2.xx","Ruijie Networks Co., Ltd. AP180-AC V3.xx"],"affected":[{"vendor":"Ruijie Networks Co., Ltd.","product":"AP180-PE V3.xx","versions":[{"version":"AP_RGOS 11.9(4)B1P8 and earlier","status":"affected"}]},{"vendor":"Ruijie Networks Co., Ltd.","product":"AP180(JA) V1.xx","versions":[{"version":"AP_RGOS 11.9(4)B1P8 and earlier","status":"affected"}]},{"vendor":"Ruijie Networks Co., Ltd.","product":"AP180(JP) V1.xx","versions":[{"version":"AP_RGOS 11.9(4)B1P8 and earlier","status":"affected"}]},{"vendor":"Ruijie Networks Co., Ltd.","product":"AP180-AC V1.xx","versions":[{"version":"AP_RGOS 11.9(4)B1P8 and earlier","status":"affected"}]},{"vendor":"Ruijie Networks Co., Ltd.","product":"AP180-PE V1.xx","versions":[{"version":"AP_RGOS 11.9(4)B1P8 and earlier","status":"affected"}]},{"vendor":"Ruijie Networks Co., Ltd.","product":"AP180(JA) V2.xx","versions":[{"version":"AP_RGOS 11.9(4)B1P8 and earlier","status":"affected"}]},{"vendor":"Ruijie Networks Co., Ltd.","product":"AP180-AC V2.xx","versions":[{"version":"AP_RGOS 11.9(4)B1P8 and earlier","status":"affected"}]},{"vendor":"Ruijie Networks Co., Ltd.","product":"AP180-PE V2.xx","versions":[{"version":"AP_RGOS 11.9(4)B1P8 and earlier","status":"affected"}]},{"vendor":"Ruijie Networks Co., Ltd.","product":"AP180-AC V3.xx","versions":[{"version":"AP_RGOS 11.9(4)B1P8 and earlier","status":"affected"}]}],"references":["https://www.ruijie.com.cn/gy/xw-aqtg-gw/930282/","https://jvn.jp/en/vu/JVNVU94068946/"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:09:56.034Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/68xxx/CVE-2025-68459.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-68459","state":"PUBLISHED","datePublished":"2025-12-18T05:51:07.988Z","dateUpdated":"2025-12-18T15:33:43.033Z","assignerShortName":"jpcert","assignerOrgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","dateReserved":"2025-12-17T23:37:17.886Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"RG - AP180, Indoor Wall Plate Wireless AP AP180 series provided by Ruijie Networks Co., Ltd. contain an OS command injection vulnerability. An arbitrary OS command may be executed on the product by an attacker who logs in to the CLI service."}],"affected":[{"vendor":"Ruijie Networks Co., Ltd.","product":"AP180-PE V3.xx","versions":[{"version":"AP_RGOS 11.9(4)B1P8 and earlier","status":"affected"}]},{"vendor":"Ruijie Networks Co., Ltd.","product":"AP180(JA) V1.xx","versions":[{"version":"AP_RGOS 11.9(4)B1P8 and earlier","status":"affected"}]},{"vendor":"Ruijie Networks Co., Ltd.","product":"AP180(JP) V1.xx","versions":[{"version":"AP_RGOS 11.9(4)B1P8 and earlier","status":"affected"}]},{"vendor":"Ruijie Networks Co., Ltd.","product":"AP180-AC V1.xx","versions":[{"version":"AP_RGOS 11.9(4)B1P8 and earlier","status":"affected"}]},{"vendor":"Ruijie Networks Co., Ltd.","product":"AP180-PE V1.xx","versions":[{"version":"AP_RGOS 11.9(4)B1P8 and earlier","status":"affected"}]},{"vendor":"Ruijie Networks Co., Ltd.","product":"AP180(JA) V2.xx","versions":[{"version":"AP_RGOS 11.9(4)B1P8 and earlier","status":"affected"}]},{"vendor":"Ruijie Networks Co., Ltd.","product":"AP180-AC V2.xx","versions":[{"version":"AP_RGOS 11.9(4)B1P8 and earlier","status":"affected"}]},{"vendor":"Ruijie Networks Co., Ltd.","product":"AP180-PE V2.xx","versions":[{"version":"AP_RGOS 11.9(4)B1P8 and earlier","status":"affected"}]},{"vendor":"Ruijie Networks Co., Ltd.","product":"AP180-AC V3.xx","versions":[{"version":"AP_RGOS 11.9(4)B1P8 and earlier","status":"affected"}]}],"references":[{"url":"https://www.ruijie.com.cn/gy/xw-aqtg-gw/930282/"},{"url":"https://jvn.jp/en/vu/JVNVU94068946/"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"HIGH","baseScore":7.2,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}},{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV4_0":{"version":"4.0","baseSeverity":"HIGH","baseScore":8.6,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"Improper neutralization of special elements used in an OS command ('OS Command Injection')","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"jpcert","orgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","dateUpdated":"2025-12-18T05:51:07.988Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-18T15:28:34.206269Z","id":"CVE-2025-68459","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-18T15:33:43.033Z"}}]}}}