CVE-2026-23699CWE-78

AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability

High · published January 22, 2026

CVSS v4.0
8.6
EPSS
2%
Percentile
75.1
In the wild
Unconfirmed
What it is

⚡ The AP180 series is vulnerable to OS command injection in firmware versions before AP_RGOS 11.9(4)B1P8, allowing attackers to run arbitrary commands! This is definitely one to tackle! 🔥 Think of this vulnerability like a delivery box with a poorly secured latch; if someone figures out how to open it, they can not only see what’s inside but also swap the contents with whatever they desire! If exploited, an attacker could execute any command on the device, leading to a complete takeover. This could result in unauthorized access to sensitive data or even a total system compromise—absolutely devastating!

Put simply

Think of this vulnerability like a delivery box with a poorly secured latch; if someone figures out how to open it, they can not only see what’s inside but also swap the contents with whatever they desire! The OS command injection allows attackers to send crafted commands that the device will execute as if they were legitimate. This opens the door for malicious actions, like manipulating device operations or accessing confidential information.

What to do

If exploited, an attacker could execute any command on the device, leading to a complete takeover. This could result in unauthorized access to sensitive data or even a total system compromise—absolutely devastating! To protect your devices, immediately upgrade firmware to version AP_RGOS 11.9(4)B1P8 or later. Additionally, review your system configurations to ensure no other vulnerabilities are present and consider implementing strict command validation. 🛡️ You've got this! By following these steps, you’ll be keeping your devices secure in no time! 💪🎉

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01564 · 75.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-01-22T01:41Z
EPSS history
Timeline
  • 22 JAN 01:41Z
    AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability
    cvelistv5