Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.
References
| Link | Resource |
|---|---|
| https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/ | Exploit Third Party Advisory |
| https://support.ruckuswireless.com/security_bulletins/315 | Patch Product Vendor Advisory |
| https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/ | Exploit Third Party Advisory |
| https://support.ruckuswireless.com/security_bulletins/315 | Patch Product Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
Configuration 6 (hide)
| AND |
|
Configuration 7 (hide)
| AND |
|
Configuration 8 (hide)
| AND |
|
History
No history.
Information
Published : 2023-02-13 20:15
Updated : 2025-01-29 16:15
NVD link : CVE-2023-25717
Mitre link : CVE-2023-25717
CVE.ORG link : CVE-2023-25717
JSON object : View
Products Affected
ruckuswireless
- t750se
- r560
- r720
- t811-cm
- r750
- r850
- smartzone
- sz300-federal
- t350d
- r600
- h510
- t310n
- r700
- t310c
- t300
- h320
- t610
- r730
- r650
- r500
- h550
- m510-jp
- t811-cm\(non-spf\)
- zd1100
- r350
- t350c
- t301s
- t750
- t504
- r300
- r320
- t310s
- t710s
- q910
- r550
- r310
- q410
- t710
- zd1000
- e510
- r510
- r710
- sz-144
- sz-144-federal
- m510
- t301n
- q710
- smartzone_ap
- sz100
- t350se
- zd5000
- p300
- h350
- r760
- ruckus_wireless_admin
- zd3000
- sz300
- r610
- t310d
- h500
- zd1200
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')