CVE-2025-46116

Exploit

EPSS 0.5%
Veröffentlicht 21.07.2025 00:00:00
Zuletzt bearbeitet 05.08.2025 17:17:40
Erkennungen
Login

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where an authenticated attacker can disable the passphrase requirement for a hidden CLI command `!v54!` via a management API call and then invoke it to escape the restricted shell and obtain a root shell on the controller.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 2 Referenzen 5

NVD 3 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Ruckuswireless ≫ Ruckus Unleashed Version < 200.15.6.212.14

   Commscope ≫ Ruckus C110 Version -
   Commscope ≫ Ruckus E510 Version -
   Commscope ≫ Ruckus H320 Version -
   Commscope ≫ Ruckus H350 Version -
   Commscope ≫ Ruckus H510 Version -
   Commscope ≫ Ruckus H550 Version -
   Commscope ≫ Ruckus M510 Version -
   Commscope ≫ Ruckus M510-jp Version -
   Commscope ≫ Ruckus R310 Version -
   Commscope ≫ Ruckus R320 Version -
   Commscope ≫ Ruckus R350 Version -
   Commscope ≫ Ruckus R350e Version -
   Commscope ≫ Ruckus R510 Version -
   Commscope ≫ Ruckus R550 Version -
   Commscope ≫ Ruckus R560 Version -
   Commscope ≫ Ruckus R610 Version -
   Commscope ≫ Ruckus R650 Version -
   Commscope ≫ Ruckus R670 Version -
   Commscope ≫ Ruckus R710 Version -
   Commscope ≫ Ruckus R720 Version -
   Commscope ≫ Ruckus R730 Version -
   Commscope ≫ Ruckus R750 Version -
   Commscope ≫ Ruckus R760 Version -
   Commscope ≫ Ruckus R770 Version -
   Commscope ≫ Ruckus R850 Version -
   Commscope ≫ Ruckus T310c Version -
   Commscope ≫ Ruckus T310n Version -
   Commscope ≫ Ruckus T310s Version -
   Commscope ≫ Ruckus T350c Version -
   Commscope ≫ Ruckus T350d Version -
   Commscope ≫ Ruckus T350se Version -
   Commscope ≫ Ruckus T610 Version -
   Commscope ≫ Ruckus T670 Version -
   Commscope ≫ Ruckus T710 Version -
   Commscope ≫ Ruckus T710s Version -
   Commscope ≫ Ruckus T750 Version -
   Commscope ≫ Ruckus T750se Version -
   Commscope ≫ Ruckus T811-cm Version -
   Commscope ≫ Zonedirector 1200 Version -

Ruckuswireless ≫ Ruckus Unleashed Version >= 200.17 < 200.17.7.0.139

Ruckuswireless ≫ Ruckus Zonedirector Version < 10.5.1.0.279

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.5%	0.399

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
CISA-ADP	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-250 Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://support.ruckuswireless.com/security_bulletins/330

Product

https://sector7.computest.nl/post/2025-07-ruckus-unleashed/

Third Party Advisory

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2025-46116

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-46116

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-46116

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2025-46116