This vulnerability affects Ruijie APs running AP_RGOS version 11.1. It allows an authenticated user to inject append-style shell commands through the command parameter of the web_action.do endpoint, resulting in root-level command execution. The impact includes unauthorized file disclosure, disruption of device functionality, and the possibility of using the compromised device to pivot within the network. The vulnerability is categorized under CWE-77 (Improper Neutralization of Special Elements used in a Command). No known exploits are reported in the wild, and no patch or vendor advisory has been provided at this time.

Successful exploitation grants an authenticated attacker root-level command execution on the affected device. This can lead to disclosure of sensitive files, disruption of device operations, and potential lateral movement or pivoting within the network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated access to the web interface of affected devices and monitor for suspicious activity related to the web_action.do endpoint.