PT-2025-30282 · Commscope · Ruckus Unleashed+1

René Ammerlaan · Published 2025-07-21 · Updated 2025-07-31 · CVE-2025-46120

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CommScope Ruckus Unleashed versions prior to 200.14.6.1.203 CommScope Ruckus ZoneDirector (affected versions not specified)

Description A path-traversal flaw exists in the web interface. This flaw allows the server to execute attacker-supplied EJS templates outside of permitted directories. A remote, unauthenticated attacker who can upload a template (e.g., via FTP) can escalate privileges and run arbitrary template code on the controller.

Recommendations CommScope Ruckus Unleashed versions prior to 200.14.6.1.203: Update to version 200.14.6.1.203 or later. CommScope Ruckus ZoneDirector: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-46120

Affected Products

Ruckus Unleashed

Ruckus Zonedirector

References · 10

• 🔥 https://sector7.computest.nl/post/2025-07-ruckus-unleashed · Exploit
• https://osv.dev/vulnerability/CVE-2025-46120 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46120 · Security Note
• https://reddit.com/r/cybersecurity/comments/1mciu0w/critical_vulnerabilities_in_ruckus_unleashed · Reddit Post
• https://support.ruckuswireless.com/security_bulletins/330 · Note
• https://twitter.com/CVEnew/status/1947307947555455400 · Twitter Post
• https://reddit.com/r/networking/comments/1mdrafm/critical_vulnerabilities_in_ruckus_unleashed · Reddit Post
• http://commscope.com · Note
• https://t.me/cveNotify/130030 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1947340895109427341 · Twitter Post