9.1Crítica
CVE-2025-46122
Descripción
An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API endpoint `/admin/_cmdstat.jsp` passes attacker-controlled input to the shell without adequate validation, enabling a remote attacker to specify a target by MAC address and execute arbitrary commands as root.
Debilidad (CWE):
CWE-77
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| ruckuswireless | ruckus unleashed | < 200.15.6.212.14 | |
| ruckuswireless | ruckus zonedirector | < 10.5.1.0.279 |
Referencias y parches
- https://support.ruckuswireless.com/security_bulletins/330 Product
- https://sector7.computest.nl/post/2025-07-ruckus-unleashed/ ExploitThird Party Advisory
Coincidencias CPE (NVD) (3)
cpe:2.3:a:ruckuswireless:ruckus_unleashed:*:*:*:*:*:*:*:*< 200.15.6.212.14cpe:2.3:a:ruckuswireless:ruckus_unleashed:*:*:*:*:*:*:*:*≥ 200.17 < 200.17.7.0.139cpe:2.3:a:ruckuswireless:ruckus_zonedirector:*:*:*:*:*:*:*:*< 10.5.1.0.279