Ruckuswireless vulnerabilities
We track 7 vulnerabilities in Ruckuswireless products across 4 products. 7 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on July 21, 2025.
Latest Ruckuswireless vulnerabilities
- 7.2 High severity
Ruckus Unleashed: Use of Externally-Controlled Format String
An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where the authenticated configuration endpoint `/admin/_conf.jsp` writes the Wi-Fi guest password to memory wit
- 9.1 Critical severity
Ruckus Unleashed: Improper Neutralization of Special Elements used in a Command
An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API endpoint `/admin/_cmdstat.jsp` passes attacker-controlled input to the shell without adequate validation, enabling a remo
- 9.8 Critical severity
Ruckus Unleashed: Use of Externally-Controlled Format String
An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions `stamgr_cfg_adpt_addStaFavourite` and `stamgr_cfg_adpt_addStaIot` pass a client hostname directly to snprintf as the format string. A remote
- 9.8 Critical severity
Ruckus Unleashed: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where a path-traversal flaw in the web interface lets the server execute attacker-supplied EJS templates outsid
- 9.1 Critical severity
Ruckus Unleashed: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where a hidden debug script `.ap_debug.sh` invoked from the restricted CLI does not properly sanitize its input
- 8.8 High severity
Ruckus Unleashed: Execution with Unnecessary Privileges
An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where an authenticated attacker can disable the passphrase requirement for a hidden CLI command `!v54!` via a m
- 9.8 Critical severity
Multiple Ruckus Wireless Products CSRF and RCE Exploited
Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.