CVE-2023-25717
About
Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.
Rainforest analyst review
Ruckus Wireless Admin, the management interface on Ruckus access points and ZoneDirector/SmartZone controllers through version 10.4, mishandles the login endpoint. An unauthenticated attacker sends a crafted HTTP GET to /forms/doLogin with a shell command embedded in the password parameter using command-substitution syntax, and the backend passes it to a shell, executing the injected command on the device. No credentials and no interaction are needed beyond reaching the web interface.
Wireless controllers and APs sit at the edge of enterprise and campus networks and are widely deployed, which is why this flaw was rapidly adopted by the AndoryuBot DDoS botnet and folded into commodity scanning. Compromise of the management plane gives an attacker control over the wireless infrastructure and a persistent foothold inside the network perimeter. Apply Ruckus firmware updates to the affected access points and controllers, and because many of these devices are managed loosely and exposed for remote administration, remove management interfaces from untrusted networks and inspect devices for signs of botnet implant activity where patching was delayed.
References
Related CVEs
Frequently asked questions
What is CVE-2023-25717?
Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.
How severe is CVE-2023-25717?
CVE-2023-25717 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2023-25717 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2023-25717?
Public advisories list the following as affected: e510, h320, h350, h500, h510, h550, +55. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2023-25717?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.