CRITICAL

CVE-2023-25717

Ruckuswireless Ruckus Wireless Admin 2023-02-13 CVSS v3.1

CVSS

9.8

KEV

Description

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.

Summary dbcve.org

Unauthenticated command injection in the Ruckus Wireless Admin web login form (reachable via /forms/doLogin) allows remote code execution by embedding shell command substitution (e.g., $(curl ...)) in the password GET parameter; no credentials are required, yielding full RCE on the affected management plane.

Mitigation

Upgrade Ruckus Wireless Admin to a vendor-fixed release beyond 10.4; until patched, restrict the admin interface to trusted management networks, block external/unauthenticated HTTP access, and ensure credentials are only transmitted via POST with server-side input validation that rejects shell metacharacters.

Proof of Concept

Patch Commit

Weakness (CWE)

CWE-94 Code Injection

EPSS Score

98.07%

Probability of exploitation in next 30 days

99.9th percentile

References

https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/ Exploit, Third Party Advisory https://support.ruckuswireless.com/security_bulletins/315 Patch, Product, Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-25717 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE