CVE-2025-46123

Katalog CVE

CVSS 7.2 · High EPSS 1,1%

Kerentanan Use of Externally-Controlled Format String pada ruckuswireless ruckus unleashed, ruckuswireless ruckus zonedirector. Skor CVSS 3.1 7.2 (High) menurut CISA ADP.

Deskripsi (NVD)

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where the authenticated configuration endpoint `/admin/_conf.jsp` writes the Wi-Fi guest password to memory with snprintf using the attacker-supplied value as the format string; a crafted password therefore triggers uncontrolled format-string processing and enables remote code execution on the controller.

Rincian

Terbit di NVD

21 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-134: Use of Externally-Controlled Format String

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://sector7.computest.nl/post/2025-07-ruckus-unleashed/ exploit · advisory pihak ketiga
• https://support.ruckuswireless.com/security_bulletins/330 product