CVEvulnerability

CVE-2025-46116

8.8 HIGH Published 2025-07-21 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-07-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-250, CWE-269

Description

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where an authenticated attacker can disable the passphrase requirement for a hidden CLI command `!v54!` via a management API call and then invoke it to escape the restricted shell and obtain a root shell on the controller.

Affected configurations

• ruckuswireless ruckus unleashed (< 200.15.6.212.14) • ruckuswireless ruckus unleashed (>= 200.17 < 200.17.7.0.139) • ruckuswireless ruckus zonedirector (< 10.5.1.0.279)

Related

Weakness · CWE (2)

  • CWE-250 Execution with Unnecessary Privileges weakness
  • CWE-269 Improper Privilege Management weakness

References