Live › vulnerability › CVE-2023-25717
Go to dashboardRuckus Wireless access point software has an unspecified flaw in its web services component that allows cross-site request forgery and remote code execution. Per the description, an attacker can run code on the device when the web services component is enabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions or disconnect product if it is end-of-life.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Ruckus Wireless Multiple Products | vendor | – | – |
| ruckuswireless ruckus wireless admin | vendor | <= 10.4 | – |
| ruckuswireless smartzone ap | vendor | < 6.1.0.0.9240 | 6.1.0.0.9240 |
| ruckuswireless smartzone ap | vendor | < 5.2.2.0.2064 | 5.2.2.0.2064 |
| ruckuswireless smartzone ap | vendor | < 3.6.2.0.795 | 3.6.2.0.795 |
| ruckuswireless smartzone ap | vendor | < 6.1.1.0.1274 | 6.1.1.0.1274 |
| commscope ruckus smartzone firmware | vendor | < 5.2.1.3 | 5.2.1.3 |
| commscope ruckus smartzone firmware | vendor | = 6.1.0.0.935 | – |
| commscope ruckus smartzone firmware | vendor | < 5.2.1.3.1695 | 5.2.1.3.1695 |
Check whether the web services component is enabled on the Ruckus AP or controller (ZoneDirector, SmartZone, or Solo); the sources do not give the exact setting or command.
Apply updates per vendor instructions, or disconnect the product if it is end-of-life (per CISA required action); the sources do not name fixed versions.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs.
CISA required action: Apply updates per vendor instructions or disconnect product if it is end-of-life.
This page as .md · .json · in your agent: get_signal("CVE-2023-25717")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.