CVE-2023-25717

Warnung

Medienbericht

Exploit

EPSS 98.07%
Veröffentlicht 13.02.2023 20:15:10
Zuletzt bearbeitet 03.11.2025 18:14:23
Erkennungen
Login

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.

Betroffene Produkte Warnungen 1 Metriken 3 CWE 1 Referenzen 8

NVD 15 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Ruckuswireless ≫ Ruckus Wireless Admin Version <= 10.4

   Ruckuswireless ≫ E510 Version -
   Ruckuswireless ≫ H320 Version -
   Ruckuswireless ≫ H350 Version -
   Ruckuswireless ≫ H510 Version -
   Ruckuswireless ≫ H550 Version -
   Ruckuswireless ≫ M510 Version -
   Ruckuswireless ≫ R310 Version -
   Ruckuswireless ≫ R320 Version -
   Ruckuswireless ≫ R350 Version -
   Ruckuswireless ≫ R510 Version -
   Ruckuswireless ≫ R550 Version -
   Ruckuswireless ≫ R610 Version -
   Ruckuswireless ≫ R650 Version -
   Ruckuswireless ≫ R710 Version -
   Ruckuswireless ≫ R720 Version -
   Ruckuswireless ≫ R730 Version -
   Ruckuswireless ≫ R750 Version -
   Ruckuswireless ≫ R760 Version -
   Ruckuswireless ≫ R850 Version -
   Ruckuswireless ≫ Sz-144 Version -
   Ruckuswireless ≫ Sz100 Version -
   Ruckuswireless ≫ Sz300 Version -
   Ruckuswireless ≫ T310c Version -
   Ruckuswireless ≫ T310d Version -
   Ruckuswireless ≫ T310n Version -
   Ruckuswireless ≫ T310s Version -
   Ruckuswireless ≫ T350c Version -
   Ruckuswireless ≫ T350d Version -
   Ruckuswireless ≫ T350se Version -
   Ruckuswireless ≫ T610 Version -
   Ruckuswireless ≫ T710 Version -
   Ruckuswireless ≫ T710s Version -
   Ruckuswireless ≫ T750 Version -
   Ruckuswireless ≫ T750se Version -
   Ruckuswireless ≫ T811-cm Version -

Ruckuswireless ≫ Smartzone Ap Version < 6.1.0.0.9240

Ruckuswireless ≫ Ruckus Wireless Admin Version <= 10.4

   Ruckuswireless ≫ E510 Version -
   Ruckuswireless ≫ H320 Version -
   Ruckuswireless ≫ H510 Version -
   Ruckuswireless ≫ M510 Version -
   Ruckuswireless ≫ R310 Version -
   Ruckuswireless ≫ R320 Version -
   Ruckuswireless ≫ R500 Version -
   Ruckuswireless ≫ R510 Version -
   Ruckuswireless ≫ R550 Version -
   Ruckuswireless ≫ R600 Version -
   Ruckuswireless ≫ R610 Version -
   Ruckuswireless ≫ R650 Version -
   Ruckuswireless ≫ R710 Version -
   Ruckuswireless ≫ R720 Version -
   Ruckuswireless ≫ R730 Version -
   Ruckuswireless ≫ R750 Version -
   Ruckuswireless ≫ R850 Version -
   Ruckuswireless ≫ T300 Version -
   Ruckuswireless ≫ T301n Version -
   Ruckuswireless ≫ T301s Version -
   Ruckuswireless ≫ T310c Version -
   Ruckuswireless ≫ T310d Version -
   Ruckuswireless ≫ T310n Version -
   Ruckuswireless ≫ T310s Version -
   Ruckuswireless ≫ T504 Version -
   Ruckuswireless ≫ T610 Version -
   Ruckuswireless ≫ T710 Version -
   Ruckuswireless ≫ T710s Version -
   Ruckuswireless ≫ T750 Version -
   Ruckuswireless ≫ T750se Version -
   Ruckuswireless ≫ T811-cm Version -

Ruckuswireless ≫ Smartzone Ap Version < 5.2.2.0.2064

Ruckuswireless ≫ Ruckus Wireless Admin Version <= 10.4

   Ruckuswireless ≫ H500 Version -
   Ruckuswireless ≫ R300 Version -
   Ruckuswireless ≫ R700 Version -

Ruckuswireless ≫ Smartzone Ap Version < 3.6.2.0.795

   Ruckuswireless ≫ H500 Version -
   Ruckuswireless ≫ R300 Version -
   Ruckuswireless ≫ R700 Version -

Ruckuswireless ≫ Ruckus Wireless Admin Version <= 10.4

Ruckuswireless ≫ R560 Version -

Ruckuswireless ≫ Smartzone Ap Version < 6.1.1.0.1274

Ruckuswireless ≫ R560 Version -

Ruckuswireless ≫ Ruckus Wireless Admin Version <= 10.4

Ruckuswireless ≫ Sz-144 Version -
Ruckuswireless ≫ Sz300 Version -

Commscope ≫ Ruckus Smartzone Firmware Version < 5.2.1.3

Ruckuswireless ≫ Sz-144 Version -
Ruckuswireless ≫ Sz300 Version -

Ruckuswireless ≫ Ruckus Wireless Admin Version <= 10.4

   Ruckuswireless ≫ Sz-144 Version -
   Ruckuswireless ≫ Sz100 Version -
   Ruckuswireless ≫ Sz300 Version -

Commscope ≫ Ruckus Smartzone Firmware Version 6.1.0.0.935

   Ruckuswireless ≫ Sz-144 Version -
   Ruckuswireless ≫ Sz100 Version -
   Ruckuswireless ≫ Sz300 Version -

Ruckuswireless ≫ Ruckus Wireless Admin Version <= 10.4

   Ruckuswireless ≫ M510-jp Version -
   Ruckuswireless ≫ P300 Version -
   Ruckuswireless ≫ Q410 Version -
   Ruckuswireless ≫ Q710 Version -
   Ruckuswireless ≫ Q910 Version -
   Ruckuswireless ≫ Zd1000 Version -
   Ruckuswireless ≫ Zd1100 Version -
   Ruckuswireless ≫ Zd1200 Version -
   Ruckuswireless ≫ Zd3000 Version -
   Ruckuswireless ≫ Zd5000 Version -

Ruckuswireless ≫ Ruckus Wireless Admin Version <= 10.4

Ruckuswireless ≫ Sz-144-federal Version -
Ruckuswireless ≫ Sz300-federal Version -

Commscope ≫ Ruckus Smartzone Firmware Version < 5.2.1.3.1695

Ruckuswireless ≫ Sz-144-federal Version -
Ruckuswireless ≫ Sz300-federal Version -

12.05.2023: CISA Known Exploited Vulnerabilities (KEV) Catalog

Multiple Ruckus Wireless Products CSRF and RCE Vulnerability

Schwachstelle

Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs.

Beschreibung

Apply updates per vendor instructions or disconnect product if it is end-of-life.

Erforderliche Maßnahmen

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	98.07%	0.999

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADP	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.

VulnDex Intel

Media Report

08.07.2026 11:49

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.

VulnDex Intel

Media Report

07.07.2026 21:04

https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/

Third Party Advisory

Exploit

https://support.ruckuswireless.com/security_bulletins/315

Patch

Vendor Advisory

Product

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-25717

US Government Resource

https://nvd.nist.gov/vuln/detail/CVE-2023-25717

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-25717

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-25717

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2023-25717

12.05.2023: CISA Known Exploited Vulnerabilities (KEV) Catalog