PT-2025-30283 · Commscope · Ruckus Unleashed

René Ammerlaan · Published 2025-07-21 · Updated 2025-07-31 · CVE-2025-46121

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CommScope Ruckus Unleashed versions prior to 200.15.6.212.14 CommScope Ruckus Unleashed versions prior to 200.17.7.0.139

Description An issue exists where the functions stamgr cfg adpt addStaFavourite and stamgr cfg adpt addStaIot improperly handle client hostnames passed to snprintf as a format string. An attacker can exploit this flaw by sending a crafted request to the authenticated endpoint /admin/ conf.jsp, or by spoofing the MAC address of a favourite station and embedding malicious format specifiers in the DHCP hostname field. This can lead to unauthenticated format-string processing and arbitrary code execution on the controller.

Recommendations CommScope Ruckus Unleashed versions prior to 200.15.6.212.14: Update to version 200.15.6.212.14 or later. CommScope Ruckus Unleashed versions prior to 200.17.7.0.139: Update to version 200.17.7.0.139 or later.

Exploit

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2025-46121

Affected Products

Ruckus Unleashed

References · 8

• 🔥 https://sector7.computest.nl/post/2025-07-ruckus-unleashed · Exploit
• https://osv.dev/vulnerability/CVE-2025-46121 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46121 · Security Note
• https://reddit.com/r/cybersecurity/comments/1mciu0w/critical_vulnerabilities_in_ruckus_unleashed · Reddit Post
• https://support.ruckuswireless.com/security_bulletins/330 · Note
• https://twitter.com/CVEnew/status/1947315101910081994 · Twitter Post
• https://reddit.com/r/networking/comments/1mdrafm/critical_vulnerabilities_in_ruckus_unleashed · Reddit Post
• http://commscope.com · Note