EXPOSURES › CVE-2023-25717

CVE-2023-25717

HIGH ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2023-05-12 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2023-25717 ↗

⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 72/100 rceexploited-in-wildunpatched

Ruckus Wireless CSRF and RCE vulnerability allows remote code execution.

Ruckus Wireless Access Points (APs) have a CSRF and RCE vulnerability in their web services component. If enabled, an attacker can perform cross-site request forgery or execute remote code, impacting ZoneDirector, SmartZone, and Solo APs. This is a high-risk vulnerability that could allow unauthorized access and execution of arbitrary code.

Shame score — The vulnerability is actively exploited and impacts multiple critical products, leading to significant exposure and potential for widespread impact.

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

Ruckus Wireless · vendor Multiple Products · product

DESCRIPTION

Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs.

AFFECTED FEDRAMP PRODUCTS · 0

No correlated FedRAMP products.