CVE-2025-46121

Опубликовано: 21 июл. 2025

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions stamgr_cfg_adpt_addStaFavourite and stamgr_cfg_adpt_addStaIot pass a client hostname directly to snprintf as the format string. A remote attacker can exploit this flaw either by sending a crafted request to the authenticated endpoint /admin/_conf.jsp, or without authentication and without direct network access to the controller by spoofing the MAC address of a favourite station and embedding malicious format specifiers in the DHCP hostname field, resulting in unauthenticated format-string processing and arbitrary code execution on the controller.

Ссылки

https://sector7.computest.nl/post/2025-07-ruckus-unleashed/
Exploit
Third Party Advisory
https://support.ruckuswireless.com/security_bulletins/330
Product

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:ruckuswireless:ruckus_unleashed:*:*:*:*:*:*:*:*

Версия до 200.15.6.212.14 (исключая)

cpe:2.3:a:ruckuswireless:ruckus_unleashed:*:*:*:*:*:*:*:*

Версия от 200.17 (включая) до 200.17.7.0.139 (исключая)

cpe:2.3:a:ruckuswireless:ruckus_zonedirector:*:*:*:*:*:*:*:*

Версия до 10.5.1.0.279 (исключая)

Одно из

cpe:2.3:h:commscope:ruckus_c110:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_e510:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_h320:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_h350:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_h510:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_h550:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_m510:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_m510-jp:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_r310:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_r320:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_r350:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_r350e:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_r510:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_r550:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_r560:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_r610:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_r650:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_r670:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_r710:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_r720:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_r730:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_r750:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_r760:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_r770:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_r850:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_t310c:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_t310n:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_t310s:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_t350c:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_t350d:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_t350se:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_t610:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_t670:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_t710:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_t710s:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_t750:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_t750se:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_t811-cm:-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:ruckus_t811-cm_\(non-sfp\):-:*:*:*:*:*:*:*

cpe:2.3:h:commscope:zonedirector_1200:-:*:*:*:*:*:*:*

EPSS

Процентиль: 74%

0.00801

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-134

Связанные уязвимости

GHSA-6c72-qmmh-6499

CVSS3: 7.2

github

7 месяцев назад

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions `stamgr_cfg_adpt_addStaFavourite` and `stamgr_cfg_adpt_addStaIot` pass a client hostname directly to snprintf as the format string. A remote attacker can exploit this flaw either by sending a crafted request to the authenticated endpoint `/admin/_conf.jsp`, or without authentication and without direct network access to the controller by spoofing the MAC address of a favourite station and embedding malicious format specifiers in the DHCP hostname field, resulting in unauthenticated format-string processing and arbitrary code execution on the controller.