PT-2026-20922 · Ruckus · Ruckus Network Director

Publicado 2026-02-19 · Atualizado 2026-02-24 · CVE-2025-67304

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ruckus Network Director versions prior to 4.5.0.54

Description Ruckus Network Director (RND) contains hardcoded credentials for the PostgreSQL database user. By default, the PostgreSQL service is accessible over the network on TCP port 5432. An attacker can use these credentials to authenticate remotely, gaining superuser access to the database. This access allows for the creation of administrative users for the web interface, extraction of password hashes, and execution of arbitrary OS commands.

Recommendations Update Ruckus Network Director to version 4.5.0.54 or later.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2025-67304

Produtos afetados

Ruckus Network Director

Referências · 4

• 🔥 https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-009-ruckus-nd-hardcoded-postgresql-credentials-rce.md · Exploit
• https://webresources.commscope.com/download/assets/RUCKUS+Network+Director%3A+Critical+Security+Bypass+Vulnerability+Leading+to+Remote+Code+Execution+and/3adeb3acb69211f08a46b6532db37357 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-67304 · Nota de Segurança
• https://twitter.com/CVEnew/status/2026265067038093637 · Publicação no Twitter