CVE-2023-25717

What it actually does

CVE-2023-25717 is an unauthenticated remote code execution vulnerability in the Ruckus Wireless Admin web interface through version 10.4. The flaw allows command injection through crafted HTTP GET parameters sent to the login endpoint, enabling an attacker reachable over the network to execute operating-system commands as the web/admin service context without credentials or user interaction. Successful exploitation can lead to full device compromise, configuration theft, traffic interception or manipulation, malware installation, persistence, lateral movement, and denial of service on affected Ruckus access points and controller platforms.

Why it matters to the business

This vulnerability is high-risk because it is remotely exploitable, requires no authentication, has a CVSS score of 9.8, has very high EPSS likelihood, is listed in CISA KEV with a remediation due date of 2023-06-02, and has been exploited in the wild for an extended period. Compromise of wireless infrastructure can disrupt business connectivity, expose network credentials and device configurations, enable attackers to pivot into internal networks, and create operational outages across sites that depend on affected access points or controllers. The broad affected product set increases the chance that unmanaged, branch, lab, or externally reachable wireless administration interfaces remain exposed.

How an attack unfolds

An attacker first identifies an exposed Ruckus Wireless Admin interface on an affected device or controller. They then send a crafted unauthenticated HTTP GET request to the login handler, commonly the /forms/doLogin endpoint, with shell metacharacters embedded in parameters such as login_username or password. If the device is vulnerable, the web component passes attacker-controlled input to an underlying command context, causing the injected command to run on the appliance. Initial commands are often lightweight checks, such as invoking curl, wget, tftp, nslookup, id, uname, or busybox to confirm execution and architecture. After confirmation, the attacker may download a payload to writable locations such as /tmp, make it executable, launch malware or a reverse shell, modify startup scripts or scheduled tasks for persistence, harvest configuration files and credentials, and use the compromised device as a foothold for scanning, proxying, DDoS activity, or lateral movement. Public exploitation has been observed broadly against Ruckus wireless products, so internet-exposed management interfaces should be treated as priority assets.

How to fix it

Upgrade affected Ruckus access points and controllers to a vendor-supported fixed firmware or software release that addresses this vulnerability. Because no exact fixed versions were provided in the input, obtain the current remediation version from the official Ruckus/CommScope security advisory and upgrade all affected models, including e510, h320, h350, h510, h550, m510, r310, r320, r350, r510, r550, r610, r650, r710, r720, r730, r750, r760, r850, sz-144, sz100, sz300, t310c, t310d, and t310n where applicable. If immediate patching is not possible, disable internet exposure of the Wireless Admin interface, restrict management access to a dedicated administrative network or VPN, block unauthenticated access to management ports at firewalls, apply ACLs on controllers and APs, rotate administrative and wireless credentials after remediation, and inspect devices for compromise before returning them to trusted operation. Consider factory reset and reconfiguration from known-good backups for devices with signs of exploitation.

How to confirm the fix worked

Confirm exposure by inventorying all Ruckus access points and controllers and verifying firmware or software versions against the vendor advisory. Validate that no Wireless Admin interface is reachable from the public internet or untrusted networks. Use authenticated administrative checks or vendor management tooling to confirm upgraded versions are deployed across all affected models. Test access-control mitigations by attempting to reach the admin interface only from approved management networks. Review web access logs for requests to /forms/doLogin containing shell metacharacters such as $(), backticks, semicolons, pipes, URL-encoded equivalents, or commands like curl, wget, tftp, busybox, sh, chmod, and nslookup. Where feasible, perform a safe, non-destructive vulnerability validation using an approved scanner or vendor-recommended check rather than sending exploit payloads manually. After patching, verify that previously suspicious requests no longer trigger command execution and that unexpected processes, files, cron entries, and outbound connections have been removed.

Typical attack path

1. Scan the internet or internal address ranges for reachable Ruckus Wireless Admin web interfaces.
2. Fingerprint the device or firmware version to identify Wireless Admin versions through 10.4 or other affected releases.
3. Send a crafted unauthenticated GET request to /forms/doLogin with command substitution or shell metacharacters in login parameters.
4. Use benign commands or outbound callbacks, such as curl, wget, tftp, nslookup, id, or uname, to validate code execution.
5. Download a payload or script to a writable directory, commonly /tmp or /var/tmp.
6. Execute the payload and establish command-and-control, proxying, botnet, or reverse shell access.
7. Collect device configuration, wireless credentials, network details, or administrative data.
8. Persist through startup scripts, cron entries, modified configuration, or repeated reinfection from external infrastructure.
9. Use the compromised wireless device to disrupt service, scan adjacent networks, pivot internally, or participate in malicious traffic.

How to detect it

To determine whether exploitation already occurred, review Ruckus Wireless Admin HTTP access logs, reverse proxy logs, firewall logs, IDS/IPS alerts, DNS logs, NetFlow, and any centralized syslog collected from affected APs or controllers. Focus on requests to /forms/doLogin that include command-substitution syntax, shell metacharacters, URL-encoded special characters, or command names in login_username or password parameters. Look for outbound HTTP, HTTPS, DNS, TFTP, or raw TCP connections from wireless infrastructure immediately after suspicious login requests, especially to unfamiliar internet hosts. On devices where shell or file-system inspection is available, look for unexpected binaries, scripts, or renamed BusyBox payloads in writable directories such as /tmp, /var/tmp, /dev/shm, and web-accessible paths. Review running processes for curl, wget, tftp, busybox, sh, ash, telnetd, nc, dropbear, suspicious architecture-specific binaries, or long-running unknown processes. Inspect cron, init, rc, startup scripts, and configuration changes for persistence. Check for configuration export events, unexpected administrative changes, new accounts, credential changes, abnormal reboots, high CPU/network utilization, scanning behavior, or DDoS-like traffic. Because exploitation has been active in the wild for years, absence of recent alerts is not sufficient; historical log review and device integrity checks are recommended.

• /forms/doLogin?login_username=
• /forms/doLogin?login_username=admin&password=
• /forms/doLogin
• login_username=admin
• password=password$(
• $(
• %24%28
• %60
• `
• ;curl
• %3Bcurl
• ;wget
• %3Bwget
• ;tftp
• %3Btftp
• |curl
• %7Ccurl
• |wget
• %7Cwget
• busybox
• /bin/sh
• /bin/ash
• chmod +x
• /tmp/
• /var/tmp/
• /dev/shm/
• curl http://
• curl https://
• wget http://
• wget https://
• tftp -g
• nslookup
• uname -a
• /etc/crontab
• /var/spool/cron
• /etc/init.d/
• /etc/rc.local
• telnetd
• dropbear
• nc -e
• /forms/doLogin?login_username=admin&password=password$(

What your security team should do

• Treat this as an urgent remediation item because it is KEV-listed, actively exploited in the wild, remotely exploitable without authentication, and has a very high EPSS score.
• Immediately identify all Ruckus Wireless Admin interfaces and remove any public or untrusted network exposure.
• Upgrade all affected Ruckus devices to vendor-supported fixed releases; replace devices that cannot be upgraded or are end-of-life.
• Prioritize externally reachable controllers and access points, branch-office devices, unmanaged devices, and any systems running Wireless Admin through 10.4.
• Search historical web, proxy, firewall, IDS, DNS, and endpoint/device logs for exploitation attempts and post-exploitation activity dating back at least to the public disclosure period, and farther where logs permit.
• Hunt specifically for command-injection patterns in /forms/doLogin requests and outbound callbacks to unknown IPs or domains shortly after those requests.
• If exploitation is suspected, isolate the device, collect logs and volatile indicators where possible, reimage or factory reset, upgrade firmware, and restore configuration from a known-good source.
• Rotate administrative passwords, wireless pre-shared keys, API credentials, SNMP communities, and any secrets stored on or managed by affected devices after remediation.
• Restrict management access using VPN, dedicated management VLANs, firewall ACLs, strong authentication, and centralized logging.
• Add SIEM detections for suspicious Ruckus login endpoint requests, command execution artifacts, and unusual outbound traffic from wireless infrastructure.