CVE-2023-25717 : Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthent

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.

Published 2023-02-13 20:15:11

Updated 2023-02-23 16:26:54

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2023-25717

Ruckuswireless » Ruckus Wireless Admin
Versions up to, including, (<=) 10.4
cpe:2.3:a:ruckuswireless:ruckus_wireless_admin:*:*:*:*:*:*:*:*
Matching versions
When used together with: Ruckuswireless » E510 » Version: N/A
When used together with: Ruckuswireless » H320 » Version: N/A
When used together with: Ruckuswireless » H350 » Version: N/A
When used together with: Ruckuswireless » H510 » Version: N/A
When used together with: Ruckuswireless » H550 » Version: N/A
When used together with: Ruckuswireless » M510 » Version: N/A
When used together with: Ruckuswireless » R310 » Version: N/A
When used together with: Ruckuswireless » R320 » Version: N/A
When used together with: Ruckuswireless » R350 » Version: N/A
When used together with: Ruckuswireless » R510 » Version: N/A
When used together with: Ruckuswireless » R550 » Version: N/A
When used together with: Ruckuswireless » R610 » Version: N/A
When used together with: Ruckuswireless » R650 » Version: N/A
When used together with: Ruckuswireless » R710 » Version: N/A
When used together with: Ruckuswireless » R720 » Version: N/A
When used together with: Ruckuswireless » R730 » Version: N/A
When used together with: Ruckuswireless » R750 » Version: N/A
When used together with: Ruckuswireless » R760 » Version: N/A
When used together with: Ruckuswireless » R850 » Version: N/A
When used together with: Ruckuswireless » Sz-144 » Version: N/A
When used together with: Ruckuswireless » Sz100 » Version: N/A
When used together with: Ruckuswireless » Sz300 » Version: N/A
When used together with: Ruckuswireless » T310c » Version: N/A
When used together with: Ruckuswireless » T310d » Version: N/A
When used together with: Ruckuswireless » T310n » Version: N/A
When used together with: Ruckuswireless » T310s » Version: N/A
When used together with: Ruckuswireless » T350c » Version: N/A
When used together with: Ruckuswireless » T350d » Version: N/A
When used together with: Ruckuswireless » T350se » Version: N/A
When used together with: Ruckuswireless » T610 » Version: N/A
When used together with: Ruckuswireless » T710 » Version: N/A
When used together with: Ruckuswireless » T710s » Version: N/A
When used together with: Ruckuswireless » T750 » Version: N/A
When used together with: Ruckuswireless » T750se » Version: N/A
When used together with: Ruckuswireless » T811-cm » Version: N/A
Ruckuswireless » Smartzone Ap
Versions before (<) 6.1.1.0.1274
cpe:2.3:o:ruckuswireless:smartzone_ap:*:*:*:*:*:*:*:*
Matching versions
When used together with: Ruckuswireless » R560 » Version: N/A
Ruckuswireless » Smartzone Ap
Versions before (<) 3.6.2.0.795
cpe:2.3:o:ruckuswireless:smartzone_ap:*:*:*:*:*:*:*:*
Matching versions
When used together with: Ruckuswireless » H500 » Version: N/A
When used together with: Ruckuswireless » R300 » Version: N/A
When used together with: Ruckuswireless » R700 » Version: N/A
Ruckuswireless » Smartzone Ap
Versions before (<) 5.2.2.0.2064
cpe:2.3:o:ruckuswireless:smartzone_ap:*:*:*:*:*:*:*:*
Matching versions
When used together with: Ruckuswireless » E510 » Version: N/A
When used together with: Ruckuswireless » H320 » Version: N/A
When used together with: Ruckuswireless » H510 » Version: N/A
When used together with: Ruckuswireless » M510 » Version: N/A
When used together with: Ruckuswireless » R310 » Version: N/A
When used together with: Ruckuswireless » R320 » Version: N/A
When used together with: Ruckuswireless » R500 » Version: N/A
When used together with: Ruckuswireless » R510 » Version: N/A
When used together with: Ruckuswireless » R550 » Version: N/A
When used together with: Ruckuswireless » R600 » Version: N/A
When used together with: Ruckuswireless » R610 » Version: N/A
When used together with: Ruckuswireless » R650 » Version: N/A
When used together with: Ruckuswireless » R710 » Version: N/A
When used together with: Ruckuswireless » R720 » Version: N/A
When used together with: Ruckuswireless » R730 » Version: N/A
When used together with: Ruckuswireless » R750 » Version: N/A
When used together with: Ruckuswireless » R850 » Version: N/A
When used together with: Ruckuswireless » T300 » Version: N/A
When used together with: Ruckuswireless » T301n » Version: N/A
When used together with: Ruckuswireless » T301s » Version: N/A
When used together with: Ruckuswireless » T310c » Version: N/A
When used together with: Ruckuswireless » T310d » Version: N/A
When used together with: Ruckuswireless » T310n » Version: N/A
When used together with: Ruckuswireless » T310s » Version: N/A
When used together with: Ruckuswireless » T504 » Version: N/A
When used together with: Ruckuswireless » T610 » Version: N/A
When used together with: Ruckuswireless » T710 » Version: N/A
When used together with: Ruckuswireless » T710s » Version: N/A
When used together with: Ruckuswireless » T750 » Version: N/A
When used together with: Ruckuswireless » T750se » Version: N/A
When used together with: Ruckuswireless » T811-cm » Version: N/A
Ruckuswireless » Smartzone Ap
Versions before (<) 6.1.0.0.9240
cpe:2.3:o:ruckuswireless:smartzone_ap:*:*:*:*:*:*:*:*
Matching versions
When used together with: Ruckuswireless » E510 » Version: N/A
When used together with: Ruckuswireless » H320 » Version: N/A
When used together with: Ruckuswireless » H350 » Version: N/A
When used together with: Ruckuswireless » H510 » Version: N/A
When used together with: Ruckuswireless » H550 » Version: N/A
When used together with: Ruckuswireless » M510 » Version: N/A
When used together with: Ruckuswireless » R310 » Version: N/A
When used together with: Ruckuswireless » R320 » Version: N/A
When used together with: Ruckuswireless » R350 » Version: N/A
When used together with: Ruckuswireless » R510 » Version: N/A
When used together with: Ruckuswireless » R550 » Version: N/A
When used together with: Ruckuswireless » R610 » Version: N/A
When used together with: Ruckuswireless » R650 » Version: N/A
When used together with: Ruckuswireless » R710 » Version: N/A
When used together with: Ruckuswireless » R720 » Version: N/A
When used together with: Ruckuswireless » R730 » Version: N/A
When used together with: Ruckuswireless » R750 » Version: N/A
When used together with: Ruckuswireless » R760 » Version: N/A
When used together with: Ruckuswireless » R850 » Version: N/A
When used together with: Ruckuswireless » Sz-144 » Version: N/A
When used together with: Ruckuswireless » Sz100 » Version: N/A
When used together with: Ruckuswireless » Sz300 » Version: N/A
When used together with: Ruckuswireless » T310c » Version: N/A
When used together with: Ruckuswireless » T310d » Version: N/A
When used together with: Ruckuswireless » T310n » Version: N/A
When used together with: Ruckuswireless » T310s » Version: N/A
When used together with: Ruckuswireless » T350c » Version: N/A
When used together with: Ruckuswireless » T350d » Version: N/A
When used together with: Ruckuswireless » T350se » Version: N/A
When used together with: Ruckuswireless » T610 » Version: N/A
When used together with: Ruckuswireless » T710 » Version: N/A
When used together with: Ruckuswireless » T710s » Version: N/A
When used together with: Ruckuswireless » T750 » Version: N/A
When used together with: Ruckuswireless » T750se » Version: N/A
When used together with: Ruckuswireless » T811-cm » Version: N/A
Ruckuswireless » Smartzone
Versions before (<) 5.2.1.3
cpe:2.3:o:ruckuswireless:smartzone:*:*:*:*:*:*:*:*
Matching versions
When used together with: Ruckuswireless » Sz-144 » Version: N/A
When used together with: Ruckuswireless » Sz300 » Version: N/A
Ruckuswireless » Smartzone
Versions before (<) 5.2.1.3.1695
cpe:2.3:o:ruckuswireless:smartzone:*:*:*:*:*:*:*:*
Matching versions
When used together with: Ruckuswireless » Sz-144-federal » Version: N/A
When used together with: Ruckuswireless » Sz300-federal » Version: N/A
Ruckuswireless » Smartzone » Version: 6.1.0.0.935
cpe:2.3:o:ruckuswireless:smartzone:6.1.0.0.935:*:*:*:*:*:*:*
Matching versions
When used together with: Ruckuswireless » Sz-144 » Version: N/A
When used together with: Ruckuswireless » Sz100 » Version: N/A
When used together with: Ruckuswireless » Sz300 » Version: N/A

CVE-2023-25717 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Multiple Ruckus Wireless Products CSRF and RCE Vulnerability

CISA required action:

Apply updates per vendor instructions or disconnect product if it is end-of-life.

CISA description:

Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector

Notes:

https://support.ruckuswireless.com/security_bulletins/315; https://nvd.nist.gov/vuln/detail/CVE-2023-25717

Added on 2023-05-12 Action due date 2023-06-02

Exploit prediction scoring system (EPSS) score for CVE-2023-25717

EPSS FAQ

94.94%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-25717

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-25717

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-25717

https://support.ruckuswireless.com/security_bulletins/315

20230208 | Security Bulletins | Ruckus Wireless Support
Patch;Product;Vendor Advisory
https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/

Proof of Concept - Ruckus Wireless Admin (=<10.4 - Unauthenticated Remote Code Execution / CSRF / SSRF) - CYBIR - Cyber Security, Incident Response, & Digital Forensics
Exploit;Third Party Advisory