CVE-2023-25717
Multiple Ruckus Wireless Products CSRF and RCE Vulnerability
Published Feb 13, 2023 · updated Jun 16, 2026 · ruckuswireless ruckus wireless admin
Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs.
Timeline
Detection, updates, and resolution for this record.
Feb 13, 2023 · Catalog
Detected
Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs.
May 12, 2023 · CISA KEV
Known exploited
Apply updates per vendor instructions or disconnect product if it is end-of-life.
Jun 2, 2023 · CISA KEV
Remediation due
Apply updates per vendor instructions or disconnect product if it is end-of-life.
Jun 16, 2026 · Catalog
Updated
Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs.
Required action
Apply updates per vendor instructions or disconnect product if it is end-of-life.
CISA due date Jun 2, 2023
Affected
- cpe ruckuswireless/ruckus wireless adminversion unspecified
- cpe ruckuswireless/smartzone apversion unspecified
- vendor Ruckus Wireless Multiple Productsversion unspecified
Sources
- CISA KEVCVE-2023-25717
Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs.
cisa.gov - CVE.orgCVE-2023-25717
Official CVE identifier
cve.org - FIRST EPSSCVE-2023-25717
30-day exploitation probability 98.1%
first.org - NIST NVDCVE-2023-25717
Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.
nvd.nist.gov