← Back

CVE-2025-46122

nvd nist
Published: Jul 21, 2025Modified: Jun 17, 2026

JSON object

Loading...
9.1
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Exploitability: 2.3 / Impact: 6.0
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API endpoint `/admin/_cmdstat.jsp` passes attacker-controlled input to the shell without adequate validation, enabling a remote attacker to specify a target by MAC address and execute arbitrary commands as root.

Affected (3)

Ruckuswireless
2 products
Ruckus Unleashed
Ruckus Zonedirector
Configuration A
3 vulnerable · 40 platform
Vulnerable SoftwareAffected Versions
Ruckuswireless
Ruckus Unleashed
Before 200.15.6.212.14
Ruckus Unleashed
From 200.17 to 200.17.7.0.139
Ruckus Zonedirector
Before 10.5.1.0.279
Running on/withPlatform Versions
Commscope
Ruckus C110
All versions
Commscope
Ruckus E510
All versions
Commscope
Ruckus H320
All versions
Commscope
Ruckus H350
All versions
Commscope
Ruckus H510
All versions
Commscope
Ruckus H550
All versions
Commscope
Ruckus M510
All versions
Commscope
Ruckus M510 Jp
All versions
Commscope
Ruckus R310
All versions
Commscope
Ruckus R320
All versions
Commscope
Ruckus R350
All versions
Commscope
Ruckus R350e
All versions
Commscope
Ruckus R510
All versions
Commscope
Ruckus R550
All versions
Commscope
Ruckus R560
All versions
Commscope
Ruckus R610
All versions
Commscope
Ruckus R650
All versions
Commscope
Ruckus R670
All versions
Commscope
Ruckus R710
All versions
Commscope
Ruckus R720
All versions
Commscope
Ruckus R730
All versions
Commscope
Ruckus R750
All versions
Commscope
Ruckus R760
All versions
Commscope
Ruckus R770
All versions
Commscope
Ruckus R850
All versions
Commscope
Ruckus T310c
All versions
Commscope
Ruckus T310n
All versions
Commscope
Ruckus T310s
All versions
Commscope
Ruckus T350c
All versions
Commscope
Ruckus T350d
All versions
Commscope
Ruckus T350se
All versions
Commscope
Ruckus T610
All versions
Commscope
Ruckus T670
All versions
Commscope
Ruckus T710
All versions
Commscope
Ruckus T710s
All versions
Commscope
Ruckus T750
All versions
Commscope
Ruckus T750se
All versions
Commscope
Ruckus T811 Cm
All versions
Commscope
Ruckus T811 Cm (non Sfp)
All versions
Commscope
Zonedirector 1200
All versions

Related CWEs

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (2)

Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
Product

Timeline

No history available yet.