CVE-2023-25717 — CRITICAL (9.8)

Q: What is CVE-2023-25717?

CVE-2023-25717 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.

Q: How severe is CVE-2023-25717?

CVE-2023-25717 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Q: Is there a patch for CVE-2023-25717?

Check the references section above for vendor advisories and patch information. Affected products include: Ruckuswireless Ruckus Wireless Admin, Ruckuswireless Smartzone Ap, Ruckuswireless E510, Ruckuswireless H320, Ruckuswireless H350.

Vulnerability Description

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Ruckuswireless	Ruckus Wireless Admin	<= 10.4
Ruckuswireless	Smartzone Ap	< 6.1.0.0.9240
Ruckuswireless	E510	-
Ruckuswireless	H320	-
Ruckuswireless	H350	-
Ruckuswireless	H510	-
Ruckuswireless	H550	-
Ruckuswireless	M510	-
Ruckuswireless	R310	-
Ruckuswireless	R320	-
Ruckuswireless	R350	-
Ruckuswireless	R510	-
Ruckuswireless	R550	-
Ruckuswireless	R610	-
Ruckuswireless	R650	-
Ruckuswireless	R710	-
Ruckuswireless	R720	-
Ruckuswireless	R730	-
Ruckuswireless	R750	-
Ruckuswireless	R760	-

Related Weaknesses (CWE)

CWE-94

References

https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthentExploitThird Party Advisory
https://support.ruckuswireless.com/security_bulletins/315PatchProductVendor Advisory
https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthentExploitThird Party Advisory
https://support.ruckuswireless.com/security_bulletins/315PatchProductVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-US Government Resource

FAQ

What is CVE-2023-25717?

CVE-2023-25717 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.

How severe is CVE-2023-25717?

CVE-2023-25717 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2023-25717?

Check the references section above for vendor advisories and patch information. Affected products include: Ruckuswireless Ruckus Wireless Admin, Ruckuswireless Smartzone Ap, Ruckuswireless E510, Ruckuswireless H320, Ruckuswireless H350.