VYPR
← All advisories
Critical severity9.1NVD Advisory· Published Jul 21, 2025· Updated Jun 17, 2026

CVE-2025-46122

CVE-2025-46122

Description

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API endpoint /admin/_cmdstat.jsp passes attacker-controlled input to the shell without adequate validation, enabling a remote attacker to specify a target by MAC address and execute arbitrary commands as root.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • Commscope/Ruckus Unleashedcpe-rescue2 versions
    (expand)+ 1 more
    • (no CPE)
    • (no CPE)range: <200.15.6.212.14, <200.17.7.0.139
  • Ruckus/Unleashed
    cpe:2.3:a:ruckuswireless:ruckus_unleashed:*:*:*:*:*:*:*:*
    Range: <200.15.6.212.14
  • Ruckus/ZoneDirector
    cpe:2.3:a:ruckuswireless:ruckus_zonedirector:*:*:*:*:*:*:*:*
    Range: <10.5.1.0.279
  • Commscope/Ruckusllm-create
    Range: <200.15.6.212.14, <200.17.7.0.139

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.