ИнструментыУязвимости БДУБлоклистыРасширениеУтилитыБлогAPIМониторинг
Главная → Уязвимости → CVE-2025-46122
9.1критическая

CVE-2025-46122

Описание

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API endpoint `/admin/_cmdstat.jsp` passes attacker-controlled input to the shell without adequate validation, enabling a remote attacker to specify a target by MAC address and execute arbitrary commands as root.

Затрагиваемое ПО
Ruckuswireless Ruckus unleashedRuckuswireless Ruckus zonedirectorCommscope Ruckus c110Commscope Ruckus e510Commscope Ruckus h320Commscope Ruckus h350Commscope Ruckus h510Commscope Ruckus h550Commscope Ruckus m510Commscope Ruckus m510-jpCommscope Ruckus r310Commscope Ruckus r320Commscope Ruckus r350Commscope Ruckus r350eCommscope Ruckus r510Commscope Ruckus r550Commscope Ruckus r560Commscope Ruckus r610Commscope Ruckus r650Commscope Ruckus r670Commscope Ruckus r710Commscope Ruckus r720Commscope Ruckus r730Commscope Ruckus r750Commscope Ruckus r760
CVSS
Балл9.1 — критическая
ВекторCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Источники
https://sector7.computest.nl/post/2025-07-ruckus-unleashed/https://support.ruckuswireless.com/security_bulletins/330