CVE-2023-25717

KEVMultiple Ruckus Wireless Products CSRF and RCE Vulnerability

Description

Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs.

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

PublishedFeb 13, 2023

Last modifiedJun 17, 2026

Added to KEVMay 12, 2023

Remediation dueJun 2, 2023

References

cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/ExploitThird Party Advisory
support.ruckuswireless.com/security_bulletins/315PatchProduct
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-25717US Government Resource

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1243 days
CVSS: 9.8 CRITICAL
EPSS (30-day exploit probability): 98.1% · top 1% of all CVEs
Weakness: CWE-94
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply updates per vendor instructions or disconnect product if it is end-of-life.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.