CVE-2025-63735 Overview
CVE-2025-63735 is a reflected Cross-Site Scripting (XSS) vulnerability in Ruckus Unleashed version 200.13.6.1.319. The flaw resides in the captive portal endpoint selfguestpass/guestAccessSubmit.jsp and is triggered through the name parameter. An attacker can craft a malicious URL that, when visited by an authenticated or guest user, executes arbitrary JavaScript in the victim's browser context. The vulnerability is classified as [CWE-79] (Improper Neutralization of Input During Web Page Generation). Successful exploitation allows session hijacking, credential theft through injected phishing forms, and browser-based redirection attacks against wireless network users.
Critical Impact
Attackers can execute arbitrary JavaScript in the browser of any user who visits a crafted captive portal URL, enabling session theft and phishing against wireless guest users.
Affected Products
- Ruckus Wireless Ruckus Unleashed 200.13.6.1.319
- Captive portal component: selfguestpass/guestAccessSubmit.jsp
- Deployments exposing the guest access portal to untrusted networks
Discovery Timeline
- 2025-11-25 - CVE-2025-63735 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-63735
Vulnerability Analysis
The vulnerability exists in the guest access submission handler of the Ruckus Unleashed captive portal. The guestAccessSubmit.jsp endpoint receives user-supplied input through the name HTTP parameter and reflects the value back into the rendered HTML response without proper output encoding or contextual sanitization.
Because the reflected content is written into an HTML context, an attacker can break out of the intended text node and inject arbitrary <script> tags or event handlers. The captive portal is typically reachable before full network authentication, expanding the attack surface to any user attempting to connect to the wireless network.
Exploitation requires user interaction, since the victim must click or be redirected to the attacker-supplied URL. However, captive portal pages are frequently opened automatically by client operating systems when joining a Wi-Fi network, which reduces the friction for social engineering.
Root Cause
The root cause is missing output encoding when the name parameter is rendered into the JSP response. The application does not neutralize HTML metacharacters such as <, >, ", and ' before reflecting the input into the page, violating the [CWE-79] output encoding requirement for web applications.
Attack Vector
The attack is network-based and requires user interaction. An attacker crafts a URL targeting selfguestpass/guestAccessSubmit.jsp with a JavaScript payload embedded in the name query parameter. When a user visits the URL, typically through phishing or a rogue access point that redirects to the legitimate captive portal, the malicious script executes in the browser.
Refer to the GitHub PoC for CVE-2025-63735 for technical details on the parameter reflection and payload structure.
Detection Methods for CVE-2025-63735
Indicators of Compromise
- HTTP requests to selfguestpass/guestAccessSubmit.jsp containing HTML or JavaScript metacharacters (<script, onerror=, javascript:) in the name parameter
- Unusual referrer headers pointing to external domains preceding captive portal access
- Client browsers making outbound requests to attacker-controlled domains immediately after captive portal load
Detection Strategies
- Deploy web application firewall rules that inspect query parameters submitted to the Ruckus Unleashed captive portal for XSS payload signatures
- Enable verbose HTTP access logging on the Unleashed controller and forward logs to a SIEM for pattern matching against known XSS vectors
- Monitor DNS and proxy telemetry for beaconing from clients that recently connected through the guest portal
Monitoring Recommendations
- Alert on any URL containing encoded script tags (%3Cscript, %3Cimg) targeting the /selfguestpass/ path
- Correlate captive portal access logs with endpoint browser telemetry to identify sessions where injected scripts executed
- Review historical access logs for the guestAccessSubmit.jsp endpoint to identify prior exploitation attempts
How to Mitigate CVE-2025-63735
Immediate Actions Required
- Restrict administrative and guest portal access to trusted management networks until a vendor patch is applied
- Deploy WAF or reverse proxy rules that strip or encode HTML metacharacters in the name parameter of guestAccessSubmit.jsp
- Notify wireless guest users to avoid clicking captive portal links received through email, SMS, or QR codes from untrusted sources
Patch Information
No vendor advisory URL was published in the NVD entry at the time of this writing. Administrators should consult Ruckus Networks product documentation and open a support case with Ruckus/CommScope to obtain a fixed firmware release addressing version 200.13.6.1.319.
Workarounds
- Disable the self-service guest pass feature if it is not required for business operations
- Place the captive portal behind a reverse proxy that performs input validation and output encoding on the name parameter
- Implement a strict Content Security Policy (CSP) at the proxy layer to block inline script execution on captive portal pages
- Segment guest wireless traffic from corporate networks to limit lateral movement if a session is hijacked
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
