Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2025-67305: RUCKUS Network Director OVA appliance: hardcoded SSH keys exposed
CVE-2025-67305 · published 8 months ago
Summary
A security risk exists in older versions of RUCKUS Network Director, where the same SSH key is hardcoded in all installations. This allows an attacker with network access to gain access to the database and potentially take control of the system. Upgrade to version 4.5.0.56 or later to fix this issue.
Original advisory text
In RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user. These keys are identical across all deployments, allowing an attacker with network ...
In RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user. These keys are identical across all deployments, allowing an attacker with network access to authenticate via SSH without a password. Once authenticated, the attacker can access the PostgreSQL database with superuser privileges, create administrative users for the web interface, and potentially escalate privileges further.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-321Use of Hard-coded Cryptographic Key
Timeline
Published19 Feb 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2025-67305 · NVD
Track software like this
Free during beta