← Database

CVE-2025-46122

CRITICAL CVSS: 9.1 Published: 2025-07-21 Modified: 2026-06-17

Description

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API endpoint `/admin/_cmdstat.jsp` passes attacker-controlled input to the shell without adequate validation, enabling a remote attacker to specify a target by MAC address and execute arbitrary commands as root.

Affected Platforms

Commscope Ruckus R710Commscope Ruckus T670Commscope Ruckus T811-Cm \(Non-Sfp\)Commscope Ruckus R320Commscope Ruckus T350DCommscope Ruckus R350ECommscope Ruckus T750Commscope Ruckus T750SeCommscope Ruckus R610Ruckuswireless Ruckus Zonedirector

Weakness Type

CWE-77

References