Vulnerabilities

TI-2025-28708 CVE-2025-44962 · GHSA-cjx4-rqcr-jjmh

RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows ../ directory traversal to read files.

LOW 24

RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows ../ directory traversal to read files.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00858 Published 2025-08-04 Fixed in 6.1.2p3 Refresh Build CWE-24

TI-2025-28707 CVE-2025-44961 · GHSA-pxq8-xx7h-h878

MEDIUM 47

In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.02055 Published 2025-08-04 Fixed in 6.1.2p3 Refresh Build CWE-78

TI-2025-28706 CVE-2025-44960 · GHSA-8v65-3h9x-p2qp

MEDIUM 44

RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01782 Published 2025-08-04 Fixed in 6.1.2p3 Refresh Build CWE-78

TI-2025-28704 CVE-2025-44957 · GHSA-fwg7-h82p-gx66

MEDIUM 42

Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build allows authentication bypass via a valid API key and crafted HTTP headers.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01123 Published 2025-08-04 Fixed in 6.1.2p3 Refresh Build CWE-288

TI-2025-28702 CVE-2025-44954 · GHSA-26hc-78hm-m2x7

MEDIUM 44

RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00746 Published 2025-08-04 Fixed in 6.1.2p3 Refresh Build CWE-1394