| CVE-2025-67305 | CRÍTICO9.8 | In RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user. These keys are identical across all deployments, allowing an attacker with network access to authenticate via SSH without a password. Once authenticated, the attacker can access the PostgreSQL database with | 19/02/2026 |
| CVE-2025-67304 | CRÍTICO9.8 | In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user. In the default configuration, the PostgreSQL service is accessible over the network on TCP port 5432. An attacker can use the hardcoded credentials to authenticate remotely, gaining sup | 19/02/2026 |
| CVE-2025-44963 | ALTO8.1 | RUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key. | 04/08/2025 |
| CVE-2025-44962 | MÉDIO4.3 | RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows ../ directory traversal to read files. | 04/08/2025 |
| CVE-2025-44961 | ALTO8.8 | In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user. | 04/08/2025 |
| CVE-2025-44960 | ALTO8.8 | RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route. | 04/08/2025 |
| CVE-2025-44958 | ALTO7.5 | RUCKUS Network Director (RND) before 4.5 stores passwords in a recoverable format. | 04/08/2025 |
| CVE-2025-44957 | ALTO8.8 | Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build allows authentication bypass via a valid API key and crafted HTTP headers. | 04/08/2025 |
| CVE-2025-44955 | ALTO8.8 | RUCKUS Network Director (RND) before 4.5 allows jailed users to obtain root access vis a weak, hardcoded password. | 04/08/2025 |
| CVE-2023-45992 | CRÍTICO9.6 | A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote, unauthenticated attacker to execute persistent XSS and CSRF attacks against a user of the admin management interface. A successful attack, combined with a certain admin activity, coul | 19/10/2023 |
| CVE-2021-33221 | CRÍTICO9.8 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Unauthenticated API Endpoints. | 07/07/2021 |
| CVE-2021-33220 | ALTO7.8 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. Hard-coded API Keys exist. | 07/07/2021 |
| CVE-2021-33219 | CRÍTICO9.8 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded Web Application Administrator Passwords for the admin and nplus1user accounts. | 07/07/2021 |
| CVE-2021-33218 | CRÍTICO9.8 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded System Passwords that provide shell access. | 07/07/2021 |
| CVE-2021-33217 | ALTO8.8 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The Web Application allows Arbitrary Read/Write actions by authenticated users. The API allows an HTTP POST of arbitrary content into any file on the filesystem as root. | 07/07/2021 |
| CVE-2021-33216 | CRÍTICO9.8 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. An Undocumented Backdoor exists, allowing shell access via a developer account. | 07/07/2021 |
| CVE-2021-33215 | MÉDIO4.3 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The API allows Directory Traversal. | 07/07/2021 |
| CVE-2020-26879 | CRÍTICO9.8 | Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorization header. | 26/10/2020 |
| CVE-2020-26878 | ALTO8.8 | Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API (/service/v1/createUser endpoint), injecting arbitrary commands that will be executed as root user via web.py. | 26/10/2020 |