CVE-2023-25717

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 98,1%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada ruckuswireless ruckus wireless admin, ruckuswireless smartzone ap +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 12 Mei 2023, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.

Rincian

Terbit di NVD

13 Februari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

98,1% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Multiple Ruckus Wireless Products CSRF and RCE Vulnerability

Masuk KEV

12 Mei 2023

Tenggat CISA

2 Juni 2023 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions or disconnect product if it is end-of-life.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.ruckuswireless.com/security_bulletins/315 patch · product · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-25717 pemerintah AS
• https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-c... exploit · advisory pihak ketiga