PT-2025-30279 · Commscope · Ruckus Unleashed+1

René Ammerlaan · Published 2025-07-21 · Updated 2025-07-31 · CVE-2025-46117

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CommScope Ruckus Unleashed versions prior to 200.15.6.212.14 and 200.17.7.0.139 CommScope Ruckus ZoneDirector versions prior to 10.5.1.0.279

Description A hidden debug script .ap debug.sh invoked from the restricted command-line interface does not properly sanitize its input. This allows an authenticated attacker to execute arbitrary commands as root on the controller or a specified target.

Recommendations Update CommScope Ruckus Unleashed to version 200.15.6.212.14 or later. Update CommScope Ruckus Unleashed to version 200.17.7.0.139 or later. Update CommScope Ruckus ZoneDirector to version 10.5.1.0.279 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-46117

Affected Products

Ruckus Unleashed

Ruckus Zonedirector

References · 10

• 🔥 https://sector7.computest.nl/post/2025-07-ruckus-unleashed · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-46117 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46117 · Vendor Advisory
• https://reddit.com/r/cybersecurity/comments/1mciu0w/critical_vulnerabilities_in_ruckus_unleashed · Reddit Post
• https://support.ruckuswireless.com/security_bulletins/330 · Note
• https://twitter.com/CVEnew/status/1947307944183234621 · Twitter Post
• https://t.me/cveNotify/130029 · Telegram Post
• https://reddit.com/r/networking/comments/1mdrafm/critical_vulnerabilities_in_ruckus_unleashed · Reddit Post
• http://commscope.com · Note
• https://twitter.com/VulmonFeeds/status/1947358814136598538 · Twitter Post