CVE-2025-44961

EUVD-2025-23527
In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.9 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
mitreCNA
9.9 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 42%
Affected Products (NVD)
VendorProductVersion
commscoperuckus_smartzone_firmware
𝑥
< 6.1.2
commscoperuckus_smartzone_firmware
6.1.2
commscoperuckus_smartzone_firmware
6.1.2:p2
commscoperuckus_smartzone_firmware
6.1.2:p3
commscoperuckus_smartzone_firmware
7.0.0
commscoperuckus_smartzone_firmware
7.1.0
commscoperuckus_network_director
𝑥
< 4.5.0.51
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://claroty.com/team82/disclosure-dashboard/cve-2025-44961
https://kb.cert.org/vuls/id/613753
https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e
https://www.kb.cert.org/vuls/id/613753