RUCKUS SmartZone 操作系统命令注入漏洞

RUCKUS SmartZone is a network controller from RUCKUS. An operating system command injection vulnerability exists in versions prior to RUCKUS SmartZone 6.1.2p3 Refresh Build, which stems from OS command injection in API routing and could lead to a security risk...

CVE-2025-44957: Authentication Bypass Using an Alternate Path or Channel

Ruckus SmartZone SZ before 6.1.2p3 Refresh Build allows authentication bypass via a valid API key and crafted HTTP headers...

CVE-2025-44962

CVE-2025-44962 affects RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build. The issue is a directory traversal vulnerability that allows authenticated or network-accessing users to read files by exploiting improper validation of ../ directory paths in SZ. Connected documents confirm the impact as ...

CVE-2025-44963

RUCKUS Network Director RND before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key...

CVE-2025-44955: Use of Hard-coded Password

RUCKUS Network Director RND before 4.5 allows jailed users to obtain root access vis a weak, hardcoded password...

CVE-2025-44957

Ruckus SmartZone SZ before 6.1.2p3 Refresh Build allows authentication bypass via a valid API key and crafted HTTP headers...

PT-2025-31827 · Ruckus · Ruckus Network Director

Name of the Vulnerable Software and Affected Versions: RUCKUS Network Director versions prior to 4.5 Description: RUCKUS Network Director RND is susceptible to an issue allowing an attacker to spoof an administrator JSON Web Token JWT if they possess knowledge of a hardcoded secret key...

CVE-2025-44961

In RUCKUS SmartZone SZ before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user...

CVE-2025-44960: Improper Neutralization of Special Elements used in an OS Command

RUCKUS SmartZone SZ before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route...

CVE-2025-44957

CVE-2025-44957 affects Ruckus SmartZone (SZ) prior to 6.1.2p3 Refresh Build. The issue enables authentication bypass using a valid API key and crafted HTTP headers, potentially granting administrator access. Connected PT security notes corroborate the affected software and specify that the workar...

CVE-2025-44961

In RUCKUS SmartZone SZ before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user...

CVE-2025-44954: Use of Default Cryptographic Key

RUCKUS SmartZone SZ before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account...

CVE-2025-44963: Use of Hard-coded Cryptographic Key

RUCKUS Network Director RND before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key...

RUCKUS SmartZone 安全漏洞

RUCKUS SmartZone is a network controller from RUCKUS. A security vulnerability exists in versions prior to the RUCKUS SmartZone 6.1.2p3 Refresh Build, which stems from hard-coded SSH private keys and could lead to a security risk...

CVE-2025-44963

CVE-2025-44963 affects RUCKUS Networks products (RND and related management tools like vSZ/RND). Connected sources describe multiple issues in these products, including hardcoded cryptographic secrets (JWT signing key) that could let an attacker forge administrator JWTs and bypass authentication,...

RUCKUS Network Director 安全漏洞

RUCKUS Network Director is a wireless network monitoring software from RUCKUS. A security vulnerability exists in RUCKUS Network Director versions prior to 4.5, which originates from an attacker being able to forge an administrator JWT with a hard-coded key...

CVE-2025-44958

RUCKUS Network Director RND before 4.5 stores passwords in a recoverable format...

CVE-2025-44960

RUCKUS SmartZone SZ before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route...

CVE-2025-44954

The CVE-2025-44954 issue affects RUCKUS SmartZone (SZ) prior to 6.1.2p3 Refresh Build, where a hardcoded SSH private key for a root-equivalent user enables privilege-level access. PT-Security summarizes multiple vSZ/RND flaws (including hardcoded keys, authentication bypass, and untrusted paramet...

CVE-2025-44961: Improper Neutralization of Special Elements used in an OS Command

In RUCKUS SmartZone SZ before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user...