CVE-2023-25717criticalunder attackCWE-94

CVE-2023-25717

Published · Updated

Follow this CVE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

95Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 98%
from disclosure to weapon
Published on NVDFeb 13
CISA KEV+88d
Action required by CISAfederal deadline: 2023-06-02

Apply updates per vendor instructions or disconnect product if it is end-of-life.

In short

Ruckus Wireless Admin before version 10.5 allows attackers to execute arbitrary code on the server without needing to log in, simply by sending a specially crafted web request. This is critical because it gives complete control of the network device to any attacker on the internet.

Technical detail

An unauthenticated remote attacker can achieve arbitrary code execution via HTTP GET requests to the /forms/doLogin endpoint by injecting shell commands into the login_username or password parameters. The vulnerability stems from improper input validation and command injection (CWE-94), allowing OS-level command execution without authentication required.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a