CVE-2025-46120

Published: Jul 21, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where a path-traversal flaw in the web interface lets the server execute attacker-supplied EJS templates outside permitted directories, allowing a remote unauthenticated attacker who can upload a template (e.g., via FTP) to escalate privileges and run arbitrary template code on the controller.

Affected (3)

Products: Ruckuswireless: Ruckus Unleashed, Ruckus Zonedirector

Ruckuswireless

2 products

Ruckus Unleashed

Ruckus Zonedirector

Configuration A

3 vulnerable · 40 platform

Vulnerable Software	Affected Versions
Ruckuswireless Ruckus Unleashed	Before 200.15.6.212.14
Ruckuswireless Ruckus Unleashed	From 200.17 to 200.17.7.0.139
Ruckuswireless Ruckus Zonedirector	Before 10.5.1.0.279

Running on/with	Platform Versions
Commscope Ruckus C110	All versions
Commscope Ruckus E510	All versions
Commscope Ruckus H320	All versions
Commscope Ruckus H350	All versions
Commscope Ruckus H510	All versions
Commscope Ruckus H550	All versions
Commscope Ruckus M510	All versions
Commscope Ruckus M510 Jp	All versions
Commscope Ruckus R310	All versions
Commscope Ruckus R320	All versions
Commscope Ruckus R350	All versions
Commscope Ruckus R350e	All versions
Commscope Ruckus R510	All versions
Commscope Ruckus R550	All versions
Commscope Ruckus R560	All versions
Commscope Ruckus R610	All versions
Commscope Ruckus R650	All versions
Commscope Ruckus R670	All versions
Commscope Ruckus R710	All versions
Commscope Ruckus R720	All versions
Commscope Ruckus R730	All versions
Commscope Ruckus R750	All versions
Commscope Ruckus R760	All versions
Commscope Ruckus R770	All versions
Commscope Ruckus R850	All versions
Commscope Ruckus T310c	All versions
Commscope Ruckus T310n	All versions
Commscope Ruckus T310s	All versions
Commscope Ruckus T350c	All versions
Commscope Ruckus T350d	All versions
Commscope Ruckus T350se	All versions
Commscope Ruckus T610	All versions
Commscope Ruckus T670	All versions
Commscope Ruckus T710	All versions
Commscope Ruckus T710s	All versions
Commscope Ruckus T750	All versions
Commscope Ruckus T750se	All versions
Commscope Ruckus T811 Cm	All versions
Commscope Ruckus T811 Cm (non Sfp)	All versions
Commscope Zonedirector 1200	All versions

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (2)

https://sector7.computest.nl/post/2025-07-ruckus-unleashed/

Source: cve@mitre.org

ExploitThird Party Advisory

https://support.ruckuswireless.com/security_bulletins/330

Source: cve@mitre.org

Product

Timeline

No history available yet.