CVE-2023-25717

CVE-2023-25717 is a command-injection flaw (CWE-94) in Ruckus Wireless Admin through version 10.4, the management interface used with Ruckus/CommScope SmartZone controllers. An unauthenticated attacker triggers it by sending a crafted HTTP GET request to /forms/doLogin, injecting shell commands (e.g., $(curl ...) substrings) into the login_username or password parameters, which the device executes. Successful exploitation yields remote code execution with full compromise of the management interface, and the same code path is also tied to CSRF/SSRF issues. Any organization running an internet-exposed Ruckus Wireless Admin or SmartZone management endpoint is affected, and the flaw has been actively exploited in the wild — botnet campaigns (notably Andoryu) used it to recruit devices, and CISA added it to the Known Exploited Vulnerabilities catalog on 2023-05-12; EPSS puts the 30-day exploitation probability at 98.1%.

What to do: Apply vendor updates per Ruckus/CommScope instructions for Wireless Admin (beyond 10.4) and SmartZone firmware, and per CISA KEV guidance disconnect any product that is end-of-life if it cannot be patched. Restrict the management interface so /forms/doLogin is not reachable from the internet, and review access logs for unauthenticated GET requests containing shell syntax such as $( ) in the login_username or password parameters to detect prior exploitation.