CVE-2025-65363
HighCVSS 7.2Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
An authenticated append-style command injection vulnerability in Ruijie APs running AP_RGOS 11.1.x allows a web user to execute arbitrary shell commands as root via the command parameter to the web_action.do endpoint. This can lead to file disclosure, device disruption, and potential network pivoting.
Risk Assessment
The risk includes full compromise of the access point, exposure of sensitive data, service disruption, and the possibility of using the device as a pivot point for attacks on internal network systems.
Recommendation
Immediately update the Ruijie AP firmware to the latest patched version. Restrict management interface access to trusted IP addresses and monitor logs for suspicious requests to the web_action.do endpoint.
Original NVD description (English source)
Authenticated append-style command-injection Ruijie APs (AP_RGOS 11.1.x) allows an authenticated web user to execute appended shell expressions as root, enabling file disclosure, device disruption, and potential network pivoting via the command parameter to the web_action.do endpoint.