Ruijie AP180 CVE-2025-68459

Exploitation requires the attacker to log in to the product's CLI service (the description states 'an attacker who logs in to the CLI service'), so valid CLI credentials at the required privilege level (PR:H) are a hard prerequisite. The vulnerability affects Ruijie Networks AP180 series indoor wall-plate wireless access points. Limiting factors: authentication to the CLI is mandatory (no unauthenticated path), the CLI service must be network-reachable from the attacker, and impact is confined to the device itself (SC:N/SI:N/SA:N - no scope change to other systems). Risk rises sharply where default, shared, or weak CLI credentials are in use or where the CLI is exposed beyond a trusted management network.

This is a moderate real-world risk rather than an urgent priority. The CVSS 4.0 score of 8.6 (High) is driven by full compromise of the affected system (VC:H/VI:H/VA:H) and network attack vector, but is materially gated by PR:H - the attacker must first authenticate to the device's CLI service. This is a post-authentication OS command injection, so the practical severity depends heavily on how CLI credentials are managed (default/shared credentials, weak passwords, or credential reuse would raise real risk substantially). EPSS is 1.41% (72nd percentile), indicating modest but non-trivial exploitation likelihood relative to the broader CVE population, consistent with a device-specific flaw requiring prior login. There is no CISA KEV listing and no public exploit identified at time of analysis, so this reflects potential rather than confirmed exploitation. The CVSS AV:N (network) is consistent with the description (remote login to a CLI service, e.g. SSH/Telnet). No signals conflict; the main uncertainty is the exact CLI privilege level required - the PR:H metric implies administrative/high-privilege login is needed to reach the vulnerable command path.

An attacker with valid CLI credentials (or default/weak credentials) connects to the AP180's remote CLI service over the network and injects OS command metacharacters into a CLI command argument, causing arbitrary commands to run on the underlying device OS. No public proof-of-concept is currently identified, and successful exploitation requires prior authentication to the CLI (PR:H).