CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 04/08/2025 |
| CVE-2025-44962 | MEDIUM4.3 | RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows ../ directory traversal to read files. | 04/08/2025 |
| CVE-2025-44961 | HIGH8.8 | In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user. | 04/08/2025 |
| CVE-2025-44960 | HIGH8.8 | RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route. | 04/08/2025 |
| CVE-2025-44958 | HIGH7.5 | RUCKUS Network Director (RND) before 4.5 stores passwords in a recoverable format. | 04/08/2025 |
| CVE-2025-44957 | HIGH8.8 | Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build allows authentication bypass via a valid API key and crafted HTTP headers. | 04/08/2025 |
| CVE-2025-44955 | HIGH8.8 | RUCKUS Network Director (RND) before 4.5 allows jailed users to obtain root access vis a weak, hardcoded password. | 04/08/2025 |
| CVE-2023-45992 | CRITICAL9.6 | A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote, unauthenticated attacker to execute persistent XSS and CSRF attacks against a user of the admin management interface. A successful attack, combined with a certain admin activity, coul | 19/10/2023 |
| CVE-2021-33221 | CRITICAL9.8 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Unauthenticated API Endpoints. | 07/07/2021 |
| CVE-2021-33220 | HIGH7.8 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. Hard-coded API Keys exist. | 07/07/2021 |
| CVE-2021-33219 | CRITICAL9.8 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded Web Application Administrator Passwords for the admin and nplus1user accounts. | 07/07/2021 |
| CVE-2021-33218 | CRITICAL9.8 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded System Passwords that provide shell access. | 07/07/2021 |
| CVE-2021-33217 | HIGH8.8 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The Web Application allows Arbitrary Read/Write actions by authenticated users. The API allows an HTTP POST of arbitrary content into any file on the filesystem as root. | 07/07/2021 |
| CVE-2021-33216 | CRITICAL9.8 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. An Undocumented Backdoor exists, allowing shell access via a developer account. | 07/07/2021 |
| CVE-2021-33215 | MEDIUM4.3 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The API allows Directory Traversal. | 07/07/2021 |
| CVE-2020-26879 | CRITICAL9.8 | Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorization header. | 26/10/2020 |
| CVE-2020-26878 | HIGH8.8 | Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API (/service/v1/createUser endpoint), injecting arbitrary commands that will be executed as root user via web.py. | 26/10/2020 |