Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-44960: RUCKUS SmartZone allows attackers to execute OS commands through API

CVE-2025-44960 · published 1 year ago

Summary

All versions of RUCKUS SmartZone prior to 6.1.2p3 Refresh Build are affected. This means an attacker could potentially access and manipulate sensitive system data, or even take control of the system, if they exploit this weakness. To stay secure, update to version 6.1.2p3 Refresh Build or later.

What to do

Update commscope ruckus_smartzone_firmware to version 6.1.2 or later.
Update commscope ruckus_network_director to version 4.5.0.51 or later.

Affected software

Vendor	Product	Affected versions
commscope	ruckus_smartzone_firmware	< 6.1.2 6.1.2 7.0.0 7.1.0 `cpe:2.3:o:commscope:ruckus_smartzone_firmware::::::::`
commscope	ruckus_network_director	< 4.5.0.51 `cpe:2.3:a:commscope:ruckus_network_director::::::::`

Original advisory text

RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route.

References

https://claroty.com/team82/disclosure-dashboard/cve-2025-44960 Third Party Advisory
https://kb.cert.org/vuls/id/613753 Third Party Advisory US Government Resource
https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+2... Vendor Advisory
https://www.kb.cert.org/vuls/id/613753

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

2% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published4 Aug 2025

Updated30 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-44960 · NVD

Track software like this

Free during beta