CVE-2025-44954: critical vulnerability in RUCKUS SmartZone
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
RUCKUS SmartZone versions before 6.1.2p3 contain a hardcoded SSH private key embedded in the system that allows anyone with access to the software to log in as a root-level user. This is critical because attackers can gain complete control over the network device without needing valid credentials.
A hardcoded SSH private key exists for a privileged user account in RUCKUS SmartZone prior to 6.1.2p3 Refresh Build. An attacker with network access or who obtains the software binary can extract the private key and establish authenticated SSH sessions with root-equivalent privileges, achieving complete system compromise without authentication bypass techniques.
In the same product, most dangerous first.