PT-2025-30280 · Commscope · Ruckus Zonedirector+1

René Ammerlaan · Published 2025-07-21 · Updated 2025-07-31 · CVE-2025-46118

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CommScope Ruckus Unleashed versions prior to 200.15.6.212.14 and 200.17.7.0.139 CommScope Ruckus ZoneDirector versions prior to 10.5.1.0.279

Description An issue was discovered where hard-coded credentials for the ftpuser account provide FTP access to the controller. This enables a remote attacker to upload or retrieve arbitrary files from writable firmware directories, potentially exposing sensitive information or compromising the controller.

Recommendations CommScope Ruckus Unleashed versions prior to 200.15.6.212.14: Update to version 200.15.6.212.14 or later. CommScope Ruckus Unleashed versions prior to 200.17.7.0.139: Update to version 200.17.7.0.139 or later. CommScope Ruckus ZoneDirector versions prior to 10.5.1.0.279: Update to version 10.5.1.0.279 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-46118

Affected Products

Ruckus Unleashed

Ruckus Zonedirector

References · 10

• 🔥 https://sector7.computest.nl/post/2025-07-ruckus-unleashed · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-46118 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46118 · Vendor Advisory
• https://twitter.com/CVEnew/status/1947307945227640890 · Twitter Post
• https://reddit.com/r/networking/comments/1mdrafm/critical_vulnerabilities_in_ruckus_unleashed · Reddit Post
• http://commscope.com · Note
• https://support.ruckuswireless.com/security_bulletins/330 · Note
• https://reddit.com/r/cybersecurity/comments/1mciu0w/critical_vulnerabilities_in_ruckus_unleashed · Reddit Post
• https://t.me/cveNotify/130061 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1947351134261133431 · Twitter Post