CVE-2023-25717: Multiple Ruckus Wireless Products CSRF and RCE Vulnerability

Vulnerability summary

CVE-2023-25717 is a critical (CVSS 9.8) Code Injection vulnerability in Ruckus Wireless Multiple Products. It is known to be exploited: CISA lists it, first on 12-05-2023. EPSS estimates a 98.07% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 13-02-2023
   PublishedVulnerability first disclosed.
2. 12-05-2023
   Added to CISA KEVMultiple Ruckus Wireless Products CSRF and RCE Vulnerability
3. 02-06-2023
   CISA remediation dueApply updates per vendor instructions or disconnect product if it is end-of-life.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.