CVE-2025-46116
Published: 21 July 2025
Summary
CVE-2025-46116 is a high-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Ruckuswireless Ruckus Unleashed. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 41.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22093
Vulnerability details
An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where an authenticated attacker can disable the passphrase requirement for a hidden CLI command `!v54!` via a management API call…
more
and then invoke it to escape the restricted shell and obtain a root shell on the controller.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables an authenticated attacker to exploit a management API to disable protection on a hidden CLI command, escaping the restricted shell to gain root access, facilitating exploitation for privilege escalation (T1068), exploitation of remote services (T1210), and abuse of network device CLI (T1059.008).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Policy addresses roles, responsibilities, and privilege management to prevent improper privilege assignments.
Access supervision ensures privileges are assigned and managed without improper escalation or retention.
Assigning group/role memberships and access authorizations (privileges) while reviewing accounts addresses improper privilege management.
Separation of duties prevents any single user from holding all privileges needed to complete a critical task, directly reducing execution with unnecessary privileges.
Directly prevents execution with more privileges than needed for assigned tasks.
Role-based training on least privilege principles reduces the chance personnel assign or retain unnecessary privileges.
Analysis of audit records can identify execution with unnecessary privileges through unusual activity patterns.
Terminating and reviewing connections manages privileges associated with internal interfaces.