CVE-2023-25717

Published Feb 13, 2023

Last updated 2 years ago

Overview

Description
Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.
Source
cve@mitre.org
NVD status
Analyzed

Social media

Hype score
Not currently trending

Risk scores

CVSS 3.1

Type
Primary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Known exploits

Data from CISA

Vulnerability name
Multiple Ruckus Wireless Products CSRF and RCE Vulnerability
Exploit added on
May 12, 2023
Exploit action due
Jun 2, 2023
Required action
Apply updates per vendor instructions or disconnect product if it is end-of-life.

Weaknesses

nvd@nist.gov
CWE-94

Configurations