CVE-2023-25717: Ruckus Wireless Admin unauthenticated command injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable RCE with a CVSS score of 9.8, KEV listing and near-maximum EPSS probability makes this an urgent patch-first issue.

What it is

Ruckus Wireless Admin through 10.4 is vulnerable to remote code execution via an unauthenticated HTTP GET request to /forms/doLogin, where the login_username and password parameters are passed to a shell command. The flaw is a code injection issue that lets an attacker run arbitrary commands on the device without credentials. It matters because the affected management interface is network reachable and the vendor has issued a patch.

Impact

An unauthenticated attacker can execute arbitrary commands on the affected Ruckus Wireless Admin device, leading to full compromise of confidentiality, integrity and availability. This can expose credentials, allow persistent access, and enable lateral movement into the managed wireless network.

Attack surface

Reached over the network via HTTP GET to /forms/doLogin on the Ruckus Wireless Admin interface. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CVE-2023-25717 is listed in CISA KEV with a due date of 2023-06-02, and EPSS shows a 30-day probability of 0.98069 (99.9th percentile). Public proof-of-concept exploit references are present, and CISA notes it was not observed in known ransomware campaigns.

What to do

• Apply the vendor patch from Ruckus security bulletin 315 as the first action.
• If the product is end-of-life and cannot be patched, disconnect it from the network per CISA guidance.
• Restrict access to the Ruckus Wireless Admin interface to trusted management networks only.
• Monitor and block external or untrusted access to /forms/doLogin and related admin endpoints.
• Rotate any credentials or secrets that may have been exposed on affected devices.

Detection

• Search web or proxy logs for HTTP GET requests to /forms/doLogin with shell metacharacters such as $(), backticks, or curl in the login_username or password parameters.
• Alert on outbound network connections from Ruckus management interfaces to unexpected external hosts.
• Review device and system logs for unexpected command execution or process creation on Ruckus Wireless Admin hosts.
• Correlate KEV and EPSS signals with asset inventory to confirm which Ruckus devices remain unpatched.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.