CVE-2025-46120
21.07.2025, 15:15
An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where a path-traversal flaw in the web interface lets the server execute attacker-supplied EJS templates outside permitted directories, allowing a remote unauthenticated attacker who can upload a template (e.g., via FTP) to escalate privileges and run arbitrary template code on the controller.
| Vendor | Product | Version |
|---|---|---|
| ruckuswireless | ruckus_unleashed | 𝑥 < 200.15.6.212.14 |
| ruckuswireless | ruckus_unleashed | 200.17 ≤ 𝑥 < 200.17.7.0.139 |
| ruckuswireless | ruckus_zonedirector | 𝑥 < 10.5.1.0.279 |
𝑥
= Vulnerable software versions