PT-2025-30281 · Commscope · Ruckus Unleashed

René Ammerlaan · Published 2025-07-21 · Updated 2025-07-31 · CVE-2025-46119

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions CommScope Ruckus Unleashed versions prior to 200.15.6.12.304 CommScope Ruckus Unleashed versions prior to 200.18.7.1.302

Description An authenticated request to the management endpoint /admin/ cmdstat.jsp discloses the administrator password in a trivially reversible obfuscated form. The same obfuscation method persists in configuration, allowing anyone who obtains the system configuration to recover the plaintext credentials.

Recommendations Update CommScope Ruckus Unleashed to version 200.15.6.12.304 or later. Update CommScope Ruckus Unleashed to version 200.18.7.1.302 or later.

Exploit

Fix

Weakness Enumeration

CWE-555

Related Identifiers

CVE-2025-46119

Affected Products

Ruckus Unleashed

References · 9

• 🔥 https://sector7.computest.nl/post/2025-07-ruckus-unleashed · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-46119 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46119 · Vendor Advisory
• https://reddit.com/r/cybersecurity/comments/1mciu0w/critical_vulnerabilities_in_ruckus_unleashed · Reddit Post
• https://support.ruckuswireless.com/security_bulletins/330 · Note
• https://twitter.com/VulmonFeeds/status/1947346014496489888 · Twitter Post
• https://reddit.com/r/networking/comments/1mdrafm/critical_vulnerabilities_in_ruckus_unleashed · Reddit Post
• http://commscope.com · Note
• https://twitter.com/CVEnew/status/1947307946477588505 · Twitter Post