PT-2026-20926 · Ruckus · Ruckus Network Director

CVE-2025-67305 · Publicado 2026-02-19 · Atualizado 2026-02-24

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RUCKUS Network Director versions prior to 4.5.0.56

Description RUCKUS Network Director (RND) OVA appliances include hardcoded SSH keys for the postgres user. These keys are consistent across all deployments. An attacker with network access can use these keys to authenticate via SSH without a password. Successful authentication grants access to the PostgreSQL database with superuser privileges, enabling the creation of administrative users for the web interface and potential privilege escalation.

Recommendations Update RUCKUS Network Director to version 4.5.0.56 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-321

Identificadores relacionados

CVE-2025-67305

Produtos afetados

Ruckus Network Director

Referências · 5

• 🔥 https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-012-ruckus-nd-hardcoded-ssh-keys-rce.md · Exploit
• https://t.me/CVEtracker/45174 · Publicação no Telegram
• https://webresources.commscope.com/download/assets/RUCKUS+Network+Director%3A+Critical+Security+Bypass+Vulnerability+Leading+to+Remote+Code+Execution+and/3adeb3acb69211f08a46b6532db37357 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2026265067944096145 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-67305 · Nota de Segurança