CVE-2025-46116: ruckuswireless ruckus_unleashed Execution with Unnecessary Privileges
Vulnerability summary
CVE-2025-46116 is a high (CVSS 8.8) Execution with Unnecessary Privileges vulnerability in ruckuswireless ruckus_unleashed. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 42.7% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 21-07-2025PublishedVulnerability first disclosed.
- 22-07-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where an authenticated attacker can disable the passphrase requirement for a hidden CLI command `!v54!` via a management API call and then invoke it to escape the restricted shell and obtain a root shell on the controller.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
0.00 pp
From 0.51% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (sector7.computest.nl)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-250Execution with Unnecessary PrivilegesThe product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
Ruckuswireless2 products
- ruckus_unleashed< 200.15.6.212.14 | ≥ 200.17, < 200.17.7.0.139
- ruckus_zonedirector< 10.5.1.0.279
1 vendor · 2 products