Actively exploited · Published Feb 13, 2023 · Assigned by mitre
CVE-2023-25717
Critical 9.8 Exploited
In plain English
A critical-severity code injection in Multiple Products from Ruckus Wireless. Attackers are actively exploiting it in the wild (listed by CISA on May 12, 2023). The chance it is exploited in the next 30 days is estimated at 98.1% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Apply updates per vendor instructions or disconnect product if it is end-of-life.
CISA guidance
Apply updates per vendor instructions or disconnect product if it is end-of-life.
Federal agencies must remediate by Jun 2, 2023.
Official description
Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H