Authentication bypass in RUCKUS SmartZone
Priority MEDIUM 42CWE-288Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-288.
Summary
Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build allows authentication bypass via a valid API key and crafted HTTP headers.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01123 66th percentileScored 2026-11-07
Fix Fixed SmartZone (RUCKUS): 6.1.2p3 Refresh Build
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| RUCKUS | SmartZone | before 6.1.2p3 Refresh Build | 6.1.2p3 Refresh Build | Patch available | CNA |
- SmartZone VendorRUCKUS Affected before 6.1.2p3 Refresh Build Fixed in 6.1.2p3 Refresh Build Patch available CNA
CPE configurations NVD · 36
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:commscope:ruckus_smartzone_firmware:*:*:*:*:*:*:*:* | before 6.1.2 | Vulnerable | CommScope, Inc. |
| cpe:2.3:o:commscope:ruckus_smartzone_firmware:6.1.2:-:*:*:*:*:*:* | 6.1.2 | Vulnerable | CommScope, Inc. |
| cpe:2.3:o:commscope:ruckus_smartzone_firmware:6.1.2:p2:*:*:*:*:*:* | 6.1.2 p2 | Vulnerable | CommScope, Inc. |
| cpe:2.3:o:commscope:ruckus_smartzone_firmware:6.1.2:p3:*:*:*:*:*:* | 6.1.2 p3 | Vulnerable | CommScope, Inc. |
| cpe:2.3:o:commscope:ruckus_smartzone_firmware:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | CommScope, Inc. |
| cpe:2.3:o:commscope:ruckus_smartzone_firmware:7.1.0:*:*:*:*:*:*:* | 7.1.0 | Vulnerable | CommScope, Inc. |
| cpe:2.3:a:commscope:ruckus_virtual_smartzone:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:a:commscope:ruckus_virtual_smartzone-federal:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_c110:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_e510:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
- cpe:2.3:o:commscope:ruckus_smartzone_firmware:*:*:*:*:*:*:*:* Versions before 6.1.2 Vulnerable ·CommScope, Inc.
- cpe:2.3:o:commscope:ruckus_smartzone_firmware:6.1.2:-:*:*:*:*:*:* Versions 6.1.2 Vulnerable ·CommScope, Inc.
- cpe:2.3:o:commscope:ruckus_smartzone_firmware:6.1.2:p2:*:*:*:*:*:* Versions 6.1.2 p2 Vulnerable ·CommScope, Inc.
- cpe:2.3:o:commscope:ruckus_smartzone_firmware:6.1.2:p3:*:*:*:*:*:* Versions 6.1.2 p3 Vulnerable ·CommScope, Inc.
- cpe:2.3:o:commscope:ruckus_smartzone_firmware:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·CommScope, Inc.
- cpe:2.3:o:commscope:ruckus_smartzone_firmware:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·CommScope, Inc.
- cpe:2.3:a:commscope:ruckus_virtual_smartzone:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:a:commscope:ruckus_virtual_smartzone-federal:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_c110:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_e510:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
Show 26 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:commscope:ruckus_h320:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_h350:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_h510:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_m510:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_r320:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_r510:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_r560:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_r610:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_r710:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_r720:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_r730:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_r750:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_smartzone_100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_smartzone_100-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_smartzone_144:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_smartzone_144-federal:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_smartzone_300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_smartzone_300-federal:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_t310c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_t310d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_t310n:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_t310s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_t350se:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_t750:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:h:commscope:ruckus_t750se:-:*:*:*:*:*:*:* | not specified by NVD | Running on | CommScope, Inc. |
| cpe:2.3:a:commscope:ruckus_network_director:*:*:*:*:*:*:*:* | before 4.5.0.51 | Vulnerable | CommScope, Inc. |
- cpe:2.3:h:commscope:ruckus_h320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_h350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_h510:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_m510:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_r320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_r510:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_r560:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_r610:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_r710:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_r720:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_r730:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_r750:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_smartzone_100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_smartzone_100-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_smartzone_144:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_smartzone_144-federal:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_smartzone_300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_smartzone_300-federal:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_t310c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_t310d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_t310n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_t310s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_t350se:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_t750:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:h:commscope:ruckus_t750se:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.
- cpe:2.3:a:commscope:ruckus_network_director:*:*:*:*:*:*:*:* Versions before 4.5.0.51 Vulnerable ·CommScope, Inc.
Remediation
- Fix · CNA SmartZone (RUCKUS) Fixed in 6.1.2p3 Refresh Build
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
RUCKUS SmartZone 6.1.2p3 Refresh Build
5 records Highest priority Priority MEDIUM 4 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2025-28707 OS command injection in RUCKUS SmartZonePriority MEDIUM 47
- TI-2025-28706 RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route.Priority MEDIUM 44
- TI-2025-28702 RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account.Priority MEDIUM 44
Timeline
- 2026-10-02 Threatist record created from CVE-2025-44957
- 2026-10-03 Alias added: GHSA-fwg7-h82p-gx66
References
More RUCKUS vulnerabilities
- TI-2016-09345 Ruckus Wireless H500 web management interface authenticated command injection CVSS 3.0HIGH 8.8
- TI-2025-28707 OS command injection in RUCKUS SmartZone CVSS 3.1CRITICAL 9.9
- TI-2025-28706 RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route. CVSS 3.1HIGH 8.8
- TI-2025-28702 RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account. CVSS 3.1CRITICAL 9.8
- TI-2025-28709 RUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an… CVSS 3.1CRITICAL 9.0
- TI-2025-28703 RUCKUS Network Director (RND) before 4.5 allows jailed users to obtain root access vis a weak, hardcoded password. CVSS 3.1HIGH 8.8
Sources
- CVE-2025-44957 · CVE Program
- CVE-2025-44957 · NVD
- FIRST EPSS
- GHSA-fwg7-h82p-gx66 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences