Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools

ruckus_smartzone_firmware

Source -

NVD

CNA CVEs -

0

ADP CVEs -

0

CISA CVEs -

0

NVD CVEs -

6
Related CVEsRelated VendorsRelated AssignersReports
6Vulnerabilities found
CVE-2025-44954
Assigner-MITRE Corporation
ShareView Details
Assigner-MITRE Corporation
CVSS Score-9||CRITICAL
EPSS-0.05% / 14.56%
||
7 Day CHG~0.00%
Published-04 Aug, 2025 | 00:00
Updated-07 Aug, 2025 | 17:55
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account.

Action-Not Available
Vendor-commscopeRUCKUS
Product-ruckus_c110ruckus_smartzone_144-federalruckus_h510ruckus_r510ruckus_e510ruckus_h320ruckus_r320ruckus_smartzone_100-druckus_smartzone_300ruckus_t350seruckus_smartzone_firmwareruckus_virtual_smartzone-federalruckus_smartzone_300-federalruckus_t310sruckus_h350ruckus_smartzone_100ruckus_m510ruckus_t310cruckus_virtual_smartzoneruckus_t750ruckus_smartzone_144ruckus_r560ruckus_r730ruckus_t750seruckus_t310nruckus_r610ruckus_r710ruckus_r720ruckus_r750ruckus_t310dSmartZone
CWE ID-CWE-1394
Use of Default Cryptographic Key
CVE-2025-44957
Assigner-MITRE Corporation
ShareView Details
Assigner-MITRE Corporation
CVSS Score-8.5||HIGH
EPSS-0.07% / 22.29%
||
7 Day CHG~0.00%
Published-04 Aug, 2025 | 00:00
Updated-07 Aug, 2025 | 17:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build allows authentication bypass via a valid API key and crafted HTTP headers.

Action-Not Available
Vendor-commscopeRUCKUS
Product-ruckus_c110ruckus_smartzone_144-federalruckus_h510ruckus_r510ruckus_e510ruckus_h320ruckus_r320ruckus_smartzone_100-druckus_smartzone_300ruckus_network_directorruckus_t350seruckus_smartzone_firmwareruckus_virtual_smartzone-federalruckus_smartzone_300-federalruckus_t310sruckus_h350ruckus_smartzone_100ruckus_m510ruckus_t310cruckus_virtual_smartzoneruckus_t750ruckus_smartzone_144ruckus_r560ruckus_r730ruckus_t750seruckus_t310nruckus_r610ruckus_r710ruckus_r720ruckus_r750ruckus_t310dSmartZone
CWE ID-CWE-288
Authentication Bypass Using an Alternate Path or Channel
CVE-2025-44960
Assigner-MITRE Corporation
ShareView Details
Assigner-MITRE Corporation
CVSS Score-8.5||HIGH
EPSS-0.13% / 32.99%
||
7 Day CHG~0.00%
Published-04 Aug, 2025 | 00:00
Updated-07 Aug, 2025 | 17:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route.

Action-Not Available
Vendor-commscopeRUCKUS
Product-ruckus_c110ruckus_smartzone_144-federalruckus_h510ruckus_r510ruckus_e510ruckus_h320ruckus_r320ruckus_smartzone_100-druckus_smartzone_300ruckus_network_directorruckus_t350seruckus_smartzone_firmwareruckus_virtual_smartzone-federalruckus_smartzone_300-federalruckus_t310sruckus_h350ruckus_smartzone_100ruckus_m510ruckus_t310cruckus_virtual_smartzoneruckus_t750ruckus_smartzone_144ruckus_r560ruckus_r730ruckus_t750seruckus_t310nruckus_r610ruckus_r710ruckus_r720ruckus_r750ruckus_t310dSmartZone
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-44961
Assigner-MITRE Corporation
ShareView Details
Assigner-MITRE Corporation
CVSS Score-9.9||CRITICAL
EPSS-0.15% / 35.62%
||
7 Day CHG~0.00%
Published-04 Aug, 2025 | 00:00
Updated-07 Aug, 2025 | 17:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user.

Action-Not Available
Vendor-commscopeRUCKUS
Product-ruckus_c110ruckus_smartzone_144-federalruckus_h510ruckus_r510ruckus_e510ruckus_h320ruckus_r320ruckus_smartzone_100-druckus_smartzone_300ruckus_network_directorruckus_t350seruckus_smartzone_firmwareruckus_virtual_smartzone-federalruckus_smartzone_300-federalruckus_t310sruckus_h350ruckus_smartzone_100ruckus_m510ruckus_t310cruckus_virtual_smartzoneruckus_t750ruckus_smartzone_144ruckus_r560ruckus_r730ruckus_t750seruckus_t310nruckus_r610ruckus_r710ruckus_r720ruckus_r750ruckus_t310dSmartZone
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-44962
Assigner-MITRE Corporation
ShareView Details
Assigner-MITRE Corporation
CVSS Score-5||MEDIUM
EPSS-0.03% / 7.26%
||
7 Day CHG~0.00%
Published-04 Aug, 2025 | 00:00
Updated-07 Aug, 2025 | 17:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows ../ directory traversal to read files.

Action-Not Available
Vendor-commscopeRUCKUS
Product-ruckus_c110ruckus_smartzone_144-federalruckus_h510ruckus_r510ruckus_e510ruckus_h320ruckus_r320ruckus_smartzone_100-druckus_smartzone_300ruckus_network_directorruckus_t350seruckus_smartzone_firmwareruckus_virtual_smartzone-federalruckus_smartzone_300-federalruckus_t310sruckus_h350ruckus_smartzone_100ruckus_m510ruckus_t310cruckus_virtual_smartzoneruckus_t750ruckus_smartzone_144ruckus_r560ruckus_r730ruckus_t750seruckus_t310nruckus_r610ruckus_r710ruckus_r720ruckus_r750ruckus_t310dSmartZone
CWE ID-CWE-24
Path Traversal: '../filedir'
CVE-2023-25717
Assigner-MITRE Corporation
ShareView Details
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-94.23% / 99.92%
||
7 Day CHG-0.12%
Published-13 Feb, 2023 | 00:00
Updated-22 Aug, 2025 | 21:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Known KEV||Action Due Date - 2023-06-02||Apply updates per vendor instructions or disconnect product if it is end-of-life.

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.

Action-Not Available
Vendor-ruckuswirelesscommscopen/aRuckus Wireless
Product-t310st710szd1000q710sz300r610t300m510-jpsmartzone_apruckus_wireless_adminr760r500zd3000q410r710ruckus_smartzone_firmwarer350h320r650h510t610r320r300r700h550q910e510r310t310ct811-cm\(non-spf\)t350cm510h350zd1200r720t301nr730r600zd1100t504t350sesz300-federalsz-144-federalt310nzd5000r750t310dp300t750ser850t350dt811-cmt750sz100t710r560h500sz-144t301sr550r510n/aMultiple Products
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')