CVE-2023-25717: Multiple Ruckus Wireless Products CSRF and RCE Vulnerability
First published: Mon Feb 13 2023(Updated: )
Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ruckus Wireless | ||
| Ruckus Wireless | <=10.4 | |
| Ruckus Wireless SmartZone AP | <6.1.0.0.9240 | |
| Ruckus Wireless E510 | ||
| Ruckus Wireless H320 | ||
| Ruckus Wireless H350 | ||
| Ruckus Wireless H510 | ||
| Ruckus Wireless H550 | ||
| Ruckus Wireless M510 | ||
| Ruckus Wireless R310 | ||
| Ruckus Wireless R320 | ||
| Ruckus Wireless R350 | ||
| Ruckus Wireless R510 | ||
| Ruckus Wireless R550 | ||
| Ruckus Wireless R610 | ||
| Ruckus Wireless R650 | ||
| Ruckus Wireless R710 | ||
| Ruckus Wireless R720 | ||
| Ruckus Wireless R730 | ||
| Ruckus Wireless R750 | ||
| Ruckus Wireless R760 | ||
| Ruckus Wireless R850 | ||
| Ruckus Wireless SmartZone 144 | ||
| Ruckus Wireless SmartZone 100 | ||
| Ruckus Wireless SZ300 Federal | ||
| Ruckus Wireless T310c | ||
| Ruckus Wireless T310d | ||
| Ruckus Wireless T310n | ||
| Ruckus Wireless T310s | ||
| Ruckus Wireless T350C | ||
| Ruckus Wireless T350D | ||
| Ruckus Wireless T350SE | ||
| Ruckus Wireless T610 | ||
| Ruckus Wireless T710 | ||
| Ruckus Wireless T710S | ||
| Ruckus Wireless T750 | ||
| Ruckus Wireless T750SE | ||
| Ruckus Wireless T811-CM | ||
| Ruckus Wireless SmartZone AP | <5.2.2.0.2064 | |
| Arris Ruckus Zoneflex R500 | ||
| Ruckus Wireless R600 | ||
| Ruckus Wireless T300 | ||
| Ruckus Wireless T301n | ||
| Ruckus Wireless T301s | ||
| Ruckus Wireless T504 | ||
| Ruckus Wireless SmartZone AP | <3.6.2.0.795 | |
| Ruckus Wireless H500 | ||
| Ruckus Wireless R300 | ||
| Ruckus Wireless R700 | ||
| Ruckus Wireless SmartZone AP | <6.1.1.0.1274 | |
| Ruckus Wireless R560 | ||
| Ruckus Wireless SmartZone | <5.2.1.3 | |
| Ruckus Wireless SmartZone | =6.1.0.0.935 | |
| Ruckus Wireless M510 | ||
| Ruckus Wireless P300 | ||
| Ruckus Wireless Q410 | ||
| Ruckus Wireless Q710 | ||
| Ruckus Wireless Q910 | ||
| Ruckus Wireless T811-CM (Non-SPF) | ||
| ruckuswireless zd1000 | ||
| Ruckus Wireless ZoneDirector 1100 | ||
| Ruckus Wireless ZD1200 | ||
| Ruckus Wireless ZoneDirector 3000 | ||
| Ruckus Wireless ZoneDirector 5000 | ||
| Ruckus Wireless SmartZone | <5.2.1.3.1695 | |
| Ruckus Wireless SmartZone 144 | ||
| Ruckus Wireless SZ300 Federal | ||
| All of | ||
| Any of | ||
| Ruckus Wireless | <=10.4 | |
| Ruckus Wireless SmartZone AP | <6.1.0.0.9240 | |
| Any of | ||
| Ruckus Wireless E510 | ||
| Ruckus Wireless H320 | ||
| Ruckus Wireless H350 | ||
| Ruckus Wireless H510 | ||
| Ruckus Wireless H550 | ||
| Ruckus Wireless M510 | ||
| Ruckus Wireless R310 | ||
| Ruckus Wireless R320 | ||
| Ruckus Wireless R350 | ||
| Ruckus Wireless R510 | ||
| Ruckus Wireless R550 | ||
| Ruckus Wireless R610 | ||
| Ruckus Wireless R650 | ||
| Ruckus Wireless R710 | ||
| Ruckus Wireless R720 | ||
| Ruckus Wireless R730 | ||
| Ruckus Wireless R750 | ||
| Ruckus Wireless R760 | ||
| Ruckus Wireless R850 | ||
| Ruckus Wireless SmartZone 144 | ||
| Ruckus Wireless SmartZone 100 | ||
| Ruckus Wireless SZ300 Federal | ||
| Ruckus Wireless T310c | ||
| Ruckus Wireless T310d | ||
| Ruckus Wireless T310n | ||
| Ruckus Wireless T310s | ||
| Ruckus Wireless T350C | ||
| Ruckus Wireless T350D | ||
| Ruckus Wireless T350SE | ||
| Ruckus Wireless T610 | ||
| Ruckus Wireless T710 | ||
| Ruckus Wireless T710S | ||
| Ruckus Wireless T750 | ||
| Ruckus Wireless T750SE | ||
| Ruckus Wireless T811-CM | ||
| All of | ||
| Any of | ||
| Ruckus Wireless | <=10.4 | |
| Ruckus Wireless SmartZone AP | <5.2.2.0.2064 | |
| Any of | ||
| Ruckus Wireless E510 | ||
| Ruckus Wireless H320 | ||
| Ruckus Wireless H510 | ||
| Ruckus Wireless M510 | ||
| Ruckus Wireless R310 | ||
| Ruckus Wireless R320 | ||
| Arris Ruckus Zoneflex R500 | ||
| Ruckus Wireless R510 | ||
| Ruckus Wireless R550 | ||
| Ruckus Wireless R600 | ||
| Ruckus Wireless R610 | ||
| Ruckus Wireless R650 | ||
| Ruckus Wireless R710 | ||
| Ruckus Wireless R720 | ||
| Ruckus Wireless R730 | ||
| Ruckus Wireless R750 | ||
| Ruckus Wireless R850 | ||
| Ruckus Wireless T300 | ||
| Ruckus Wireless T301n | ||
| Ruckus Wireless T301s | ||
| Ruckus Wireless T310c | ||
| Ruckus Wireless T310d | ||
| Ruckus Wireless T310n | ||
| Ruckus Wireless T310s | ||
| Ruckus Wireless T504 | ||
| Ruckus Wireless T610 | ||
| Ruckus Wireless T710 | ||
| Ruckus Wireless T710S | ||
| Ruckus Wireless T750 | ||
| Ruckus Wireless T750SE | ||
| Ruckus Wireless T811-CM | ||
| All of | ||
| Any of | ||
| Ruckus Wireless | <=10.4 | |
| Ruckus Wireless SmartZone AP | <3.6.2.0.795 | |
| Any of | ||
| Ruckus Wireless H500 | ||
| Ruckus Wireless R300 | ||
| Ruckus Wireless R700 | ||
| All of | ||
| Any of | ||
| Ruckus Wireless | <=10.4 | |
| Ruckus Wireless SmartZone AP | <6.1.1.0.1274 | |
| Ruckus Wireless R560 | ||
| All of | ||
| Any of | ||
| Ruckus Wireless | <=10.4 | |
| Ruckus Wireless SmartZone | <5.2.1.3 | |
| Any of | ||
| Ruckus Wireless SmartZone 144 | ||
| Ruckus Wireless SZ300 Federal | ||
| All of | ||
| Any of | ||
| Ruckus Wireless | <=10.4 | |
| Ruckus Wireless SmartZone | =6.1.0.0.935 | |
| Any of | ||
| Ruckus Wireless SmartZone 144 | ||
| Ruckus Wireless SmartZone 100 | ||
| Ruckus Wireless SZ300 Federal | ||
| All of | ||
| Ruckus Wireless | <=10.4 | |
| Any of | ||
| Ruckus Wireless M510 | ||
| Ruckus Wireless P300 | ||
| Ruckus Wireless Q410 | ||
| Ruckus Wireless Q710 | ||
| Ruckus Wireless Q910 | ||
| Ruckus Wireless T811-CM (Non-SPF) | ||
| ruckuswireless zd1000 | ||
| Ruckus Wireless ZoneDirector 1100 | ||
| Ruckus Wireless ZD1200 | ||
| Ruckus Wireless ZoneDirector 3000 | ||
| Ruckus Wireless ZoneDirector 5000 | ||
| All of | ||
| Any of | ||
| Ruckus Wireless | <=10.4 | |
| Ruckus Wireless SmartZone | <5.2.1.3.1695 | |
| Any of | ||
| Ruckus Wireless SmartZone 144 | ||
| Ruckus Wireless SZ300 Federal |
Remedy
Apply updates per vendor instructions or disconnect product if it is end-of-life.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-25717?
CVE-2023-25717 has been rated as a critical vulnerability due to its potential for remote code execution without authentication.
How do I fix CVE-2023-25717?
To mitigate CVE-2023-25717, it is recommended to upgrade Ruckus Wireless Administration software to a patched version beyond 10.4.
What type of vulnerability is CVE-2023-25717?
CVE-2023-25717 is classified as a remote code execution vulnerability that allows attackers to execute commands on the affected system.
What products are affected by CVE-2023-25717?
CVE-2023-25717 affects multiple Ruckus Wireless products running the administration software version 10.4 and certain SmartZone AP versions.
How does CVE-2023-25717 exploit occur?
The exploitation of CVE-2023-25717 occurs via an unauthenticated HTTP GET request that can be crafted to execute arbitrary commands.
- agent/type
- agent/remedy
- agent/weakness
- agent/description
- agent/severity
- agent/title
- agent/first-publish-date
- agent/references
- agent/author
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/tags
- agent/softwarecombine
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/nvd-api
- source/NVD
- collector/nvd-cve
- vendor/ruckus wireless
- canonical/ruckus wireless
- vendor/ruckuswireless
- version/ruckus wireless/10.4
- canonical/ruckus wireless smartzone ap
- canonical/ruckus wireless e510
- canonical/ruckus wireless h320
- canonical/ruckus wireless h350
- canonical/ruckus wireless h510
- canonical/ruckus wireless h550
- canonical/ruckus wireless m510
- canonical/ruckus wireless r310
- canonical/ruckus wireless r320
- canonical/ruckus wireless r350
- canonical/ruckus wireless r510
- canonical/ruckus wireless r550
- canonical/ruckus wireless r610
- canonical/ruckus wireless r650
- canonical/ruckus wireless r710
- canonical/ruckus wireless r720
- canonical/ruckus wireless r730
- canonical/ruckus wireless r750
- canonical/ruckus wireless r760
- canonical/ruckus wireless r850
- canonical/ruckus wireless smartzone 144
- canonical/ruckus wireless smartzone 100
- canonical/ruckus wireless sz300 federal
- canonical/ruckus wireless t310c
- canonical/ruckus wireless t310d
- canonical/ruckus wireless t310n
- canonical/ruckus wireless t310s
- canonical/ruckus wireless t350c
- canonical/ruckus wireless t350d
- canonical/ruckus wireless t350se
- canonical/ruckus wireless t610
- canonical/ruckus wireless t710
- canonical/ruckus wireless t710s
- canonical/ruckus wireless t750
- canonical/ruckus wireless t750se
- canonical/ruckus wireless t811-cm
- canonical/arris ruckus zoneflex r500
- canonical/ruckus wireless r600
- canonical/ruckus wireless t300
- canonical/ruckus wireless t301n
- canonical/ruckus wireless t301s
- canonical/ruckus wireless t504
- canonical/ruckus wireless h500
- canonical/ruckus wireless r300
- canonical/ruckus wireless r700
- canonical/ruckus wireless r560
- canonical/ruckus wireless smartzone
- version/ruckus wireless smartzone/6.1.0.0.935
- canonical/ruckus wireless p300
- canonical/ruckus wireless q410
- canonical/ruckus wireless q710
- canonical/ruckus wireless q910
- canonical/ruckus wireless t811-cm (non-spf)
- canonical/ruckuswireless zd1000
- canonical/ruckus wireless zonedirector 1100
- canonical/ruckus wireless zd1200
- canonical/ruckus wireless zonedirector 3000
- canonical/ruckus wireless zonedirector 5000