CVE-2025-67304: Critical severity Ruckus Network Director vulnerability
In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user. In the default configuration, the PostgreSQL service is accessible over the network on TCP port 5432. An attacker can use the hardcoded credentials to authenticate remotely, gaining superuser access to the database. This allows creation of administrative users for the web interface, extraction of password hashes, and execution of arbitrary OS commands.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67304?
CVE-2025-67304 has been classified as a critical vulnerability due to the presence of hardcoded credentials and accessible database service.
How do I fix CVE-2025-67304?
To fix CVE-2025-67304, upgrade your Ruckus Network Director software to version 4.5.0.54 or higher where the hardcoded credentials issue has been addressed.
What impact does CVE-2025-67304 have on my network?
CVE-2025-67304 allows attackers to potentially gain unauthorized access to your PostgreSQL database, leading to data breaches or service disruptions.
Which versions of Ruckus Network Director are affected by CVE-2025-67304?
CVE-2025-67304 affects all Ruckus Network Director versions prior to 4.5.0.54.
Is there a workaround for CVE-2025-67304?
While upgrading is the best solution for CVE-2025-67304, consider restricting network access to the PostgreSQL service as an immediate temporary measure.