Security readout for executives and security teams
Plain-English summary
CVE-2026-23699 affects several Ruijie AP180 wireless access point models running AP_RGOS firmware before 11.9(4)B1P8. A highly privileged attacker could execute operating system commands on the device. This is important for networks using these access points, but the sources do not indicate active exploitation.
Executive priority
Treat as a high-priority infrastructure maintenance item for environments using Ruijie AP180 devices. Patch or validate promptly, especially for centrally managed or sensitive wireless networks. It is not currently supported as an emergency active-exploitation issue by the provided sources.
Technical view
This is a CWE-78 OS command injection vulnerability in Ruijie AP180 series firmware prior to AP_RGOS 11.9(4)B1P8. CVSS 4.0 is 8.6 High with network attack vector, low complexity, no user interaction, and high privileges required. Successful exploitation may allow arbitrary command execution on the affected device.
Likely exposure
Exposure is limited to listed Ruijie AP180 variants on firmware earlier than AP_RGOS 11.9(4)B1P8. Risk is higher where device management interfaces are reachable by many administrators or broader networks. High privileges are required according to the CVSS vector.
Exploitation context
The provided sources and KEV status do not show active exploitation or public weaponization. The vulnerability is still serious because compromise of wireless infrastructure can affect network availability and trust. The exact vulnerable function or management interface is not described in the source bundle.
Researcher notes
Affected versions and products are documented, but the public bundle does not identify the vulnerable endpoint, parameter, or proof-of-concept. CVSS indicates exploitation requires high privileges over the network. Avoid assuming unauthenticated exposure unless vendor advisories later state otherwise.
Mitigation direction
- Inventory Ruijie AP180 series access points across the environment.
- Upgrade affected devices to AP_RGOS 11.9(4)B1P8 or later if vendor guidance confirms availability.
- Restrict management access to trusted administration networks and accounts.
- Review Ruijie and JVN advisories for model-specific update instructions.
- Prioritize devices in sensitive offices, production networks, or internet-adjacent management zones.
Validation and detection
- Confirm each AP180 model and hardware revision against the affected product list.
- Check installed AP_RGOS version on each device.
- Verify firmware is not earlier than 11.9(4)B1P8.
- Confirm management interfaces are not broadly reachable.
- Review administrative activity logs for unexpected configuration or command-related changes.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-23699 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.6HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ruijie.co.jp/products/rg-ap180-pe_p432111650928590848.html#productDocumentCVE reference
- https://jvn.jp/en/jp/JVN86850670/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.