CVE-2023-25717
Multiple Ruckus Wireless Products CSRF and RCE Vulnerability
Description
CVE-2023-25717 is a critical remote code execution vulnerability in Ruckus Wireless Admin through version 10.4 that allows unauthenticated attackers to execute arbitrary commands on affected access points via a crafted HTTP GET request. The vulnerability exists in the login form processing mechanism, where command injection is possible through unsanitized input parameters in the authentication endpoint. An attacker can exploit this by injecting shell commands into the login request without any prior authentication, achieving full remote code execution on the underlying operating system. With a CVSS score of 9.8 (Critical), an EPSS score of 94.2% placing it in the 99.9th percentile, and its inclusion in CISA's Known Exploited Vulnerabilities catalog, CVE-2023-25717 represents one of the most dangerous and actively exploited vulnerabilities in wireless network infrastructure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ruckuswireless | ruckus wireless admin | <= 10.4 |
| ruckuswireless | smartzone ap | < 6.1.0.0.9240; < 5.2.2.0.2064; < 3.6.2.0.795; < 6.1.1.0.1274 |
| commscope | ruckus smartzone firmware | < 5.2.1.3; 6.1.0.0.935; < 5.2.1.3.1695 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/(Exploit, Third Party Advisory)
- https://support.ruckuswireless.com/security_bulletins/315(Patch, Product, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-25717(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code (Code Injection)
CVE-2023-25717 is classified under CWE-94 (Code Injection), where the Ruckus Wireless Admin web interface fails to properly sanitize user-supplied input in the login form handler, allowing an attacker to inject and execute arbitrary operating system commands. The vulnerable endpoint processes URL parameters without adequate input validation, enabling command injection through shell metacharacters appended to authentication parameters.
Learn more: CWE-94 — Improper Control of Generation of Code (Code Injection)
Impact Analysis
Attack Vector (Network): CVE-2023-25717 is remotely exploitable over the network through a simple HTTP GET request to the Ruckus Wireless Admin web interface, requiring no physical access to the device. Attack Complexity (Low): exploitation is trivial, requiring only a crafted HTTP request with shell commands injected into URL parameters. Privileges Required (None): no authentication or credentials are needed, as the vulnerability exists in the login endpoint itself and can be exploited before any authentication occurs. User Interaction (None): the attack is fully automated and requires no action from any administrator or user. Confidentiality (High): successful exploitation grants full command execution on the device, exposing all stored data including wireless credentials, network configurations, and connected client information. Integrity (High): the attacker can modify device configurations, install backdoors, alter wireless network settings, and pivot to attack connected clients. Availability (High): the attacker can disable the access point, disrupt wireless services, or render the device inoperable. With a CVSS score of 9.8 (Critical) and an EPSS score of 94.2%, CVE-2023-25717 poses an extreme risk to any organization with internet-exposed Ruckus wireless infrastructure, as exploitation is trivial and achieves complete device compromise.
Exploit Maturity
Public exploit code is widely available for CVE-2023-25717, with proof-of-concept exploits published by security researchers demonstrating unauthenticated remote code execution through crafted HTTP GET requests. CISA has confirmed active exploitation in the wild by adding this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 2, 2023. Ruckus Wireless published security bulletin 315 with patches addressing the vulnerability. The EPSS score of 94.2% at the 99.9th percentile indicates near-certain exploitation activity, reflecting both the trivial nature of the exploit (a single HTTP request) and the large number of internet-exposed Ruckus devices. The combination of unauthenticated access, low exploitation complexity, and critical impact makes this vulnerability a prime target for botnet operators, initial access brokers, and ransomware groups seeking to compromise network infrastructure as a foothold for broader attacks.
Remediation
- Apply vendor patches immediately: Update Ruckus Wireless Admin and SmartZone firmware to the latest versions that address CVE-2023-25717 as specified in Ruckus security bulletin 315. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA required remediation by June 2, 2023.
- Restrict management interface access: Ensure the Ruckus Wireless Admin web interface is not accessible from the internet. Place management interfaces on isolated management VLANs and restrict access to authorized administrator IP addresses using firewall rules.
- Deploy web application firewall rules: Implement WAF or IPS rules to detect and block command injection patterns in HTTP requests targeting Ruckus management endpoints, specifically monitoring for shell metacharacters in URL parameters to /forms/doLogin.
- Audit for compromise indicators: Review device logs for suspicious HTTP requests to the login endpoint containing shell command syntax (such as , backticks, or pipe characters). Check for unauthorized configuration changes, unexpected scheduled tasks, or unknown processes running on affected access points.
- Conduct network segmentation review: Ensure wireless access points are properly segmented from critical network resources. Verify that compromised access points cannot be used to pivot into sensitive network segments or intercept enterprise traffic.
Technical Details
CVE-2023-25717 is a code injection vulnerability (CWE-94) in the Ruckus Wireless Admin web management interface through version 10.4. The vulnerability resides in the /forms/doLogin endpoint, which processes HTTP GET requests for authentication. The login handler passes user-supplied URL parameters directly to system shell commands without proper input sanitization or escaping. An attacker can inject arbitrary operating system commands by appending shell metacharacters to the password parameter, such as syntax. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst-case scenario for a web application vulnerability: network-accessible, low complexity, no authentication required, no user interaction needed, and full impact across all three security objectives. The scope is unchanged, meaning the execution occurs within the context of the access point's operating system, but since Ruckus access points typically run with root privileges, the practical impact is complete device compromise. Affected products include Ruckus Wireless Admin through 10.4, Ruckus SmartZone AP firmware, and CommScope Ruckus SmartZone firmware. The fix involves proper input validation and sanitization of all user-supplied parameters before they are passed to shell execution contexts.
Frequently Asked Questions
Is CVE-2023-25717 being actively exploited?
Yes, CVE-2023-25717 is actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 2, 2023, and public proof-of-concept exploit code is widely available. The EPSS score of 94.2% at the 99.9th percentile confirms extremely high exploitation activity targeting Ruckus wireless infrastructure.
What products are affected by CVE-2023-25717?
CVE-2023-25717 affects Ruckus Wireless Admin through version 10.4, Ruckus SmartZone AP firmware, and CommScope Ruckus SmartZone firmware. Any Ruckus access point or wireless controller running the vulnerable web administration interface is at risk of unauthenticated remote code execution.
How do I fix CVE-2023-25717?
Update all Ruckus wireless products to the latest firmware versions as specified in Ruckus security bulletin 315. Immediately restrict management interface access to trusted networks only, and ensure no Ruckus Admin interfaces are exposed to the internet.
How severe is CVE-2023-25717?
CVE-2023-25717 has a CVSS score of 9.8 (Critical severity) with maximum impact on confidentiality, integrity, and availability. The vulnerability allows unauthenticated remote code execution through a simple HTTP request, making it trivially exploitable. With an EPSS score of 94.2% and active exploitation confirmed, this is among the most dangerous vulnerabilities in wireless network infrastructure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.