CVE-2025-44960: Ruckus SmartZone Firmware RCE Vulnerability

CVE-2025-44960 Overview

CVE-2025-44960 is an operating system command injection vulnerability affecting RUCKUS SmartZone (SZ) wireless network controllers before version 6.1.2p3 Refresh Build. The flaw exists in an API route where a specific parameter is passed to an underlying OS command without proper sanitization. An authenticated attacker with low privileges can inject arbitrary shell commands over the network, gaining execution on the controller. The vulnerability is tracked under CWE-78 and was disclosed by Claroty Team82 in coordination with CommScope and CERT/CC.

Critical Impact
Authenticated attackers can execute arbitrary OS commands on RUCKUS SmartZone controllers, compromising the management plane of entire wireless fleets including access points and federal-variant deployments.

Affected Products

RUCKUS SmartZone firmware versions before 6.1.2p3 Refresh Build, including 6.1.2, 6.1.2p2, 7.0.0, and 7.1.0
RUCKUS Virtual SmartZone and Virtual SmartZone-Federal
RUCKUS Network Director and physical SmartZone controllers (SZ100, SZ100-D, SZ144, SZ144-Federal, SZ300, SZ300-Federal) plus managed access points (R-series, T-series, H-series, M510, E510, C110)

Discovery Timeline

2025-08-04 - CVE-2025-44960 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-44960

Vulnerability Analysis

The vulnerability is an OS command injection flaw in the RUCKUS SmartZone management interface. SmartZone exposes administrative and configuration functions through REST API routes consumed by the web console. One of those routes accepts a parameter that is concatenated into a shell command executed on the controller's underlying Linux operating system.

Because the parameter is not validated or escaped, an attacker can append shell metacharacters such as ;, |, `, or $() to break out of the intended argument context. The injected payload runs with the privileges of the API backend process, which on SmartZone controllers typically operates with elevated rights over the management plane.

Successful exploitation grants the attacker code execution on the controller that orchestrates Wi-Fi access points across an enterprise or federal network. This position enables tampering with AP configurations, capturing client traffic metadata, pivoting to internal networks, or persisting on the appliance.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The vulnerable API handler builds a shell command string using untrusted input from a request parameter without using safe argument arrays or input allow-listing. Both standalone SmartZone firmware and the Virtual SmartZone application share the affected codebase, which is why the impact spans hardware, virtual, and federal variants.

Attack Vector

Exploitation requires network access to the SmartZone management API and valid credentials with low privilege. The attacker sends a crafted HTTP request to the affected API route, embedding shell metacharacters in the vulnerable parameter. No user interaction is required, and the attack completes with a single request. Public exploitation details have been published by Claroty Team82; see the Claroty CVE-2025-44960 Disclosure and CERT Vulnerability Note VU#613753 for additional technical context.

Detection Methods for CVE-2025-44960

Indicators of Compromise

Unexpected child processes spawned from the SmartZone web or API service, such as sh, bash, wget, curl, nc, or python invocations originating from the management daemon.
HTTP requests to SmartZone API endpoints containing shell metacharacters (;, |, &&, backticks, $()) in parameter values.
Outbound connections from the SmartZone controller to unfamiliar external hosts, particularly on non-standard ports.
New or modified files in writable directories such as /tmp or /var/tmp on the controller appliance.

Detection Strategies

Inspect SmartZone API access logs for anomalous parameter content and requests from administrative accounts that deviate from normal operator behavior.
Deploy network IDS signatures that flag command injection payload patterns in HTTPS traffic to SmartZone management interfaces after TLS termination at a reverse proxy.
Correlate authentication events with subsequent API activity to identify low-privilege accounts performing actions associated with shell execution.

Monitoring Recommendations

Forward SmartZone audit logs, syslog, and API access logs to a centralized SIEM and alert on shell metacharacters in request parameters.
Baseline outbound network traffic from SmartZone controllers and alert on deviations such as new destinations or protocols.
Monitor for configuration changes on managed access points that occur outside scheduled change windows.

How to Mitigate CVE-2025-44960

Immediate Actions Required

Upgrade SmartZone firmware to 6.1.2p3 Refresh Build or later as published in the CommScope Security Advisory ID 20250710.
Restrict network reachability of the SmartZone management interface to a dedicated administrative VLAN or jump-host network.
Rotate credentials for all SmartZone administrative and operator accounts and review accounts for least-privilege scope.
Audit recent API activity and shell-level logs on controllers for evidence of prior exploitation.

Patch Information

CommScope addressed CVE-2025-44960 in RUCKUS SmartZone 6.1.2p3 Refresh Build. Customers running 6.1.2, 6.1.2p2, 7.0.0, 7.1.0, Virtual SmartZone, Virtual SmartZone-Federal, or Network Director should consult the vendor advisory for the appropriate fixed build for their deployment. Patch details are documented in the CommScope Security Advisory ID 20250710.

Workarounds

Place SmartZone management interfaces behind a firewall that only permits inbound connections from explicitly authorized administrator workstations.
Enforce multi-factor authentication on any identity provider integrated with SmartZone to reduce the value of low-privilege credentials.
Disable or remove unused administrative accounts and inactive API tokens until firmware can be updated.