A critical OS command injection vulnerability in Ruijie Networks AP180 series access points permits authenticated attackers to execute arbitrary commands on the underlying system.

This flaw is an OS command injection (CWE-78) occurring when the device fails to properly sanitize special elements in input. According to the CVSS vector, this vulnerability requires high privileges (PR:H) to trigger, meaning an authenticated administrator must initiate the malicious command.

Successful exploitation of this vulnerability allows an attacker to achieve full system compromise, as it permits the execution of arbitrary commands with elevated privileges. Given the CVSS score of 7.2, this represents a high-severity risk that could lead to unauthorized network control, lateral movement, or the permanent disruption of wireless services within the organization.

Immediate Action: Update all affected Ruijie Networks AP180 series access points to firmware version AP_RGOS 11.9(4)B1P8 or later immediately.

Proactive Monitoring: Review administrative access logs for unusual command execution patterns or unauthorized configuration changes on management interfaces.

Compensating Controls: Restrict access to the management interface of the access points to trusted administrative IP addresses only to prevent unauthorized users from reaching the vulnerable endpoint.

Public Exploit Available: No.

The presence of an OS command injection vulnerability in network infrastructure components poses a significant risk to organizational integrity. Administrators should prioritize the deployment of the firmware update AP_RGOS 11.9(4)B1P8 across all identified AP180 units to remediate this flaw and prevent potential exploitation of the command injection vector.