CVE-2025-46120: Path Traversal
An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where a path-traversal flaw in the web interface lets the server execute attacker-supplied EJS templates outside permitted directories, allowing a remote unauthenticated attacker who can upload a template (e.g., via FTP) to escalate privileges and run arbitrary template code on the controller.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46120?
CVE-2025-46120 is considered a high severity vulnerability due to the potential for remote code execution via a path-traversal flaw.
What products are affected by CVE-2025-46120?
CVE-2025-46120 affects CommScope Ruckus Unleashed versions prior to 200.14.6.1.203 and CommScope Ruckus ZoneDirector versions prior to 10.5.1.0.282.
How do I fix CVE-2025-46120?
To remediate CVE-2025-46120, upgrade to Ruckus Unleashed version 200.14.6.1.203 or later and Ruckus ZoneDirector version 10.5.1.0.282 or later.
Is CVE-2025-46120 exploitable remotely?
Yes, CVE-2025-46120 can be exploited by a remote unauthenticated attacker with the ability to upload files through the web interface.
What kind of attack vectors does CVE-2025-46120 expose?
CVE-2025-46120 exposes the system to potential remote code execution attacks via manipulated EJS templates using the web interface.