CVE-2025-46120

CRITICAL

Ruckus Unleashed < 200.15.6.212.27 & ZoneDirector < 10.5.1.0.282 - Path Traversal & Arbitrary Template Execution

Title source: llm
STIX 2.1

Description

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where a path-traversal flaw in the web interface lets the server execute attacker-supplied EJS templates outside permitted directories, allowing a remote unauthenticated attacker who can upload a template (e.g., via FTP) to escalate privileges and run arbitrary template code on the controller.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0094
EPSS Percentile 56.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-22
Status published
Products (2)
ruckuswireless/ruckus_unleashed < 200.15.6.212.14
ruckuswireless/ruckus_zonedirector < 10.5.1.0.279
Published Jul 21, 2025
Tracked Since Feb 18, 2026