CVE-2025-65363

High · 7.2

CVSS

7.2

EPSS

6.7%

Published

Dec 8, 2025

CISA due date

—

The record

Authenticated append-style command-injection Ruijie APs (AP_RGOS 11.1.x) allows an authenticated web user to execute appended shell expressions as root, enabling file disclosure, device disruption, and potential network pivoting via the command parameter to the web_action.do endpoint.

Affected packages

Ecosystem	Package	Introduced	Fixed