What is CVE-2023-25717?

CVE-2023-25717 is a critical vulnerability in Ruckus Wireless Admin up to version 10.4, leading to remote code execution via an unauthenticated HTTP GET request. It affects various Ruckus Wireless products, including access points, controllers, and management systems, putting environments like hotels, schools, stadiums, and other outdoor areas at ris

Who is impacted by this?

The CVE-2023-25717 vulnerability affects users of Ruckus Wireless Admin up to version 10.4. This critical vulnerability allows remote code execution through an unauthenticated HTTP GET request, posing a significant risk to the security of affected systems. Users of Ruckus Wireless Admin versions 10.4 and earlier should be aware of this vulnerability and take necessary precautions to protect their networks.

What to do if CVE-2023-25717 affected you

If you're affected by the CVE-2023-25717 vulnerability, it's crucial to take action to protect your network. Here are some simple steps to follow:

1. Check for available updates or patches from Ruckus Wireless.

2. Keep your software up-to-date and apply security patches as needed.

3. Monitor your network for suspicious activity and report any incidents to the vendor.

4. Follow best practices for securing web applications and maintaining a secure network environment.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-25717 vulnerability, also known as "Multiple Ruckus Wireless Products CSRF and RCE Vulnerability," is indeed present in CISA's Known Exploited Vulnerabilities Catalog. It was added on May 12, 2023, and the due date for addressing the vulnerability is June 2, 2023.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-94, which involves improper control of code generation, leading to code injection.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• Proof of Concept - Ruckus Wireless Admin (=<10.4 - Unauthenticated Remote Code Execution / CSRF / SSRF) - CYBIR

• Security Bulletins - Ruckus Wireless

• BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

• Known Exploited Vulnerabilities Catalog