Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools

SmartZone

Source -

CNA

CNA CVEs -

6

ADP CVEs -

0

CISA CVEs -

0

NVD CVEs -

0
Related CVEsRelated VendorsRelated AssignersReports
6Vulnerabilities found

CVE-2025-44954
Assigner-MITRE Corporation
ShareView Details
Assigner-MITRE Corporation
CVSS Score-9||CRITICAL
EPSS-0.05% / 14.56%
||
7 Day CHG~0.00%
Published-04 Aug, 2025 | 00:00
Updated-07 Aug, 2025 | 17:55
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account.

Action-Not Available
Vendor-commscopeRUCKUS
Product-ruckus_c110ruckus_smartzone_144-federalruckus_h510ruckus_r510ruckus_e510ruckus_h320ruckus_r320ruckus_smartzone_100-druckus_smartzone_300ruckus_t350seruckus_smartzone_firmwareruckus_virtual_smartzone-federalruckus_smartzone_300-federalruckus_t310sruckus_h350ruckus_smartzone_100ruckus_m510ruckus_t310cruckus_virtual_smartzoneruckus_t750ruckus_smartzone_144ruckus_r560ruckus_r730ruckus_t750seruckus_t310nruckus_r610ruckus_r710ruckus_r720ruckus_r750ruckus_t310dSmartZone
CWE ID-CWE-1394
Use of Default Cryptographic Key
CVE-2025-44957
Assigner-MITRE Corporation
ShareView Details
Assigner-MITRE Corporation
CVSS Score-8.5||HIGH
EPSS-0.07% / 22.29%
||
7 Day CHG~0.00%
Published-04 Aug, 2025 | 00:00
Updated-07 Aug, 2025 | 17:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build allows authentication bypass via a valid API key and crafted HTTP headers.

Action-Not Available
Vendor-commscopeRUCKUS
Product-ruckus_c110ruckus_smartzone_144-federalruckus_h510ruckus_r510ruckus_e510ruckus_h320ruckus_r320ruckus_smartzone_100-druckus_smartzone_300ruckus_network_directorruckus_t350seruckus_smartzone_firmwareruckus_virtual_smartzone-federalruckus_smartzone_300-federalruckus_t310sruckus_h350ruckus_smartzone_100ruckus_m510ruckus_t310cruckus_virtual_smartzoneruckus_t750ruckus_smartzone_144ruckus_r560ruckus_r730ruckus_t750seruckus_t310nruckus_r610ruckus_r710ruckus_r720ruckus_r750ruckus_t310dSmartZone
CWE ID-CWE-288
Authentication Bypass Using an Alternate Path or Channel
CVE-2025-44960
Assigner-MITRE Corporation
ShareView Details
Assigner-MITRE Corporation
CVSS Score-8.5||HIGH
EPSS-0.13% / 32.99%
||
7 Day CHG~0.00%
Published-04 Aug, 2025 | 00:00
Updated-07 Aug, 2025 | 17:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route.

Action-Not Available
Vendor-commscopeRUCKUS
Product-ruckus_c110ruckus_smartzone_144-federalruckus_h510ruckus_r510ruckus_e510ruckus_h320ruckus_r320ruckus_smartzone_100-druckus_smartzone_300ruckus_network_directorruckus_t350seruckus_smartzone_firmwareruckus_virtual_smartzone-federalruckus_smartzone_300-federalruckus_t310sruckus_h350ruckus_smartzone_100ruckus_m510ruckus_t310cruckus_virtual_smartzoneruckus_t750ruckus_smartzone_144ruckus_r560ruckus_r730ruckus_t750seruckus_t310nruckus_r610ruckus_r710ruckus_r720ruckus_r750ruckus_t310dSmartZone
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-44961
Assigner-MITRE Corporation
ShareView Details
Assigner-MITRE Corporation
CVSS Score-9.9||CRITICAL
EPSS-0.15% / 35.62%
||
7 Day CHG~0.00%
Published-04 Aug, 2025 | 00:00
Updated-07 Aug, 2025 | 17:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user.

Action-Not Available
Vendor-commscopeRUCKUS
Product-ruckus_c110ruckus_smartzone_144-federalruckus_h510ruckus_r510ruckus_e510ruckus_h320ruckus_r320ruckus_smartzone_100-druckus_smartzone_300ruckus_network_directorruckus_t350seruckus_smartzone_firmwareruckus_virtual_smartzone-federalruckus_smartzone_300-federalruckus_t310sruckus_h350ruckus_smartzone_100ruckus_m510ruckus_t310cruckus_virtual_smartzoneruckus_t750ruckus_smartzone_144ruckus_r560ruckus_r730ruckus_t750seruckus_t310nruckus_r610ruckus_r710ruckus_r720ruckus_r750ruckus_t310dSmartZone
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-44962
Assigner-MITRE Corporation
ShareView Details
Assigner-MITRE Corporation
CVSS Score-5||MEDIUM
EPSS-0.03% / 7.26%
||
7 Day CHG~0.00%
Published-04 Aug, 2025 | 00:00
Updated-07 Aug, 2025 | 17:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows ../ directory traversal to read files.

Action-Not Available
Vendor-commscopeRUCKUS
Product-ruckus_c110ruckus_smartzone_144-federalruckus_h510ruckus_r510ruckus_e510ruckus_h320ruckus_r320ruckus_smartzone_100-druckus_smartzone_300ruckus_network_directorruckus_t350seruckus_smartzone_firmwareruckus_virtual_smartzone-federalruckus_smartzone_300-federalruckus_t310sruckus_h350ruckus_smartzone_100ruckus_m510ruckus_t310cruckus_virtual_smartzoneruckus_t750ruckus_smartzone_144ruckus_r560ruckus_r730ruckus_t750seruckus_t310nruckus_r610ruckus_r710ruckus_r720ruckus_r750ruckus_t310dSmartZone
CWE ID-CWE-24
Path Traversal: '../filedir'
CVE-2023-49225
Assigner-JPCERT/CC
ShareView Details
Assigner-JPCERT/CC
CVSS Score-6.1||MEDIUM
EPSS-0.32% / 54.60%
||
7 Day CHG~0.00%
Published-07 Dec, 2023 | 06:22
Updated-22 Aug, 2025 | 21:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in the product. As for the affected products/models/versions, see the information provided by the vendor listed under [References] section or the list under [Product Status] section.

Action-Not Available
Vendor-commscoperuckuswirelessCommScope, Inc.
Product-t310st750_firmwaret305r610r550_firmwarer720_firmwaret710s_firmwareh320_firmwarer850_firmwaret750se_firmwarer350t305_firmwarer650h510r320r760_firmwaree510r310t310cr560_firmwaret350ct310s_firmwaret310n_firmwareh350zonedirector_firmwarer350_firmwarem510_firmwarer720t310d_firmwarezonedirectort310nt310c_firmwaret350dr510_firmwarec110_firmwarer510r730_firmwaret710st350se_firmwareh350_firmwarer760t350c_firmwarer710h510_firmwareh320r710_firmwarer310_firmwarer750_firmwaret610h550r610_firmwarem510t610ssmartzone_firmwaree510_firmwarer730h550_firmwaret350set710_firmwarer750t610_firmwaret310dt350d_firmwarec110r850t750set750t710r320_firmwarer560r550ruckus_smartzoner650_firmwaret610s_firmwareAP Solo R510AP Solo T310DAP Solo T350seAP Solo T750SEAP Solo T350dAP Solo R550AP Solo R730AP Solo T710AP Solo T310SAP Solo T750AP Solo R850AP Solo R720SmartZoneAP Solo R750AP Solo R560AP Solo H320AP Solo R760AP Solo C110AP Solo R310AP Solo R350ZoneDirectorAP Solo E510AP Solo H550AP Solo T305AP Solo R710AP Solo R650AP Solo T610sAP Solo R610AP Solo R320AP Solo T310CAP Solo H510AP Solo T350cAP Solo T710sAP Solo T310NAP Solo H350AP Solo T610AP Solo M510
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')