CVE-2025-44961: Ruckus SmartZone Firmware RCE Vulnerability

CVE-2025-44961 Overview

CVE-2025-44961 is an operating system (OS) command injection vulnerability affecting RUCKUS SmartZone (SZ) wireless LAN controllers and associated CommScope Ruckus access points. The flaw exists in versions before 6.1.2p3 Refresh Build and allows an authenticated user to inject arbitrary OS commands through an IP address input field. Successful exploitation grants the attacker code execution on the underlying controller, which manages enterprise wireless infrastructure. The vulnerability is tracked under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact
An authenticated attacker can execute arbitrary OS commands on RUCKUS SmartZone controllers, compromising the management plane of all access points enrolled in the controller.

Affected Products

CommScope RUCKUS SmartZone Firmware before 6.1.2p3 Refresh Build (including 6.1.2, 6.1.2p2, 7.0.0, 7.1.0)
RUCKUS Virtual SmartZone and Virtual SmartZone-Federal
RUCKUS SmartZone 100, 100-D, 144, 144-Federal, 300, 300-Federal, RUCKUS Network Director, and managed access points (R320/R510/R560/R610/R710/R720/R730/R750, T310/T350SE/T750/T750SE, H320/H350/H510, M510, E510, C110)

Discovery Timeline

2025-08-04 - CVE-2025-44961 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-44961

Vulnerability Analysis

The vulnerability resides in a management interface input handler that accepts an IP address string from an authenticated user. The application passes this user-controlled value to an underlying shell or system call without sufficient validation or sanitization. By appending shell metacharacters such as ;, |, &&, or backticks to a value the parser treats as an IP address, an attacker breaks out of the intended command context and runs arbitrary commands as the service account.

Because SmartZone controllers centrally manage hundreds to thousands of access points, code execution on the controller exposes administrative credentials, RADIUS secrets, certificates, and configuration data for the entire wireless fabric. The attack requires only low-privilege authenticated access, and the management plane is typically reachable from internal networks and administrative VLANs.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The vulnerable code path concatenates an attacker-controlled IP address string into a command line invoked through a system shell rather than executing the underlying binary directly with argument arrays or applying a strict IPv4/IPv6 regex allowlist.

Attack Vector

Exploitation occurs over the network against the SmartZone management interface. The attacker must hold valid credentials, but no user interaction is required. The IP address field, intended for operations such as diagnostics or remote target specification, is the injection point. The injected payload executes with the privileges of the management service on the controller.

No public proof-of-concept exploit is listed for CVE-2025-44961. Refer to the Claroty CVE-2025-44961 Disclosure and CERT Vulnerability ID 613753 for additional technical context.

Detection Methods for CVE-2025-44961

Indicators of Compromise

Unexpected child processes (for example /bin/sh, wget, curl, nc, python) spawned by the SmartZone management daemon on the controller.
Outbound connections from the SmartZone controller to non-RUCKUS infrastructure, including DNS lookups to attacker-controlled domains.
Audit log entries showing IP address fields containing shell metacharacters such as ;, |, `, $(, or &&.
New or modified files in writable controller directories such as /tmp, /var/tmp, or operator home directories.

Detection Strategies

Inspect SmartZone administrative API and Web UI request logs for IP address parameters containing non-numeric, non-dot characters.
Correlate authenticated administrative sessions with subsequent outbound network activity from the controller management interface.
Hunt for shell command patterns in process telemetry sourced from controller syslog forwarding.

Monitoring Recommendations

Forward SmartZone syslog and audit events to a centralized SIEM and alert on command-injection metacharacter patterns in user-supplied fields.
Monitor for unauthorized configuration changes and new administrator accounts on the controller.
Restrict and log all administrative access to SmartZone via jump hosts with session recording.

How to Mitigate CVE-2025-44961

Immediate Actions Required

Upgrade RUCKUS SmartZone to 6.1.2p3 Refresh Build or later as directed by the CommScope Security Advisory ID 20250710.
Rotate all administrative passwords, API tokens, and shared secrets stored on the controller after patching.
Restrict management interface reachability to a dedicated administrative VLAN or jump host.
Review controller audit logs for command-injection indicators dating back to deployment of any affected firmware version.

Patch Information

CommScope has released fixed firmware in 6.1.2p3 Refresh Build. Customers running the 7.0.0 and 7.1.0 branches identified in the affected CPE list should consult the vendor advisory for the appropriate fixed build for their release train. The advisory is available at the CommScope Security Advisory ID 20250710.

Workarounds

Limit administrative accounts on SmartZone to a minimum set of trusted operators and enforce multi-factor authentication where supported.
Block management interface access from user, guest, and untrusted networks at the firewall or ACL level.
Disable or restrict access to diagnostic features that accept IP address input until the patch is applied.

bash

# Example ACL restricting SmartZone management access to a jump host
ip access-list extended SMARTZONE-MGMT
 permit tcp host 10.10.20.5 host 10.0.0.10 eq 443
 permit tcp host 10.10.20.5 host 10.0.0.10 eq 22
 deny   ip any host 10.0.0.10 log
 permit ip any any