https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-46123.htmlhttps://patchthecve.com/cve/CVE-2025-46123.htmlWed, 17 Jun 2026 09:25:58 +0000HIGH 7.2: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where the authenticated configuration endpoint `/admin/_conf.jsp` writes the Wi-Fi guest password to memory with snprintf using the attacker-supplied vhttps://patchthecve.com/cve/CVE-2025-46122.htmlhttps://patchthecve.com/cve/CVE-2025-46122.htmlWed, 17 Jun 2026 09:25:57 +0000CRITICAL 9.1: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API endpoint `/admin/_cmdstat.jsp` passes attacker-controlled input to the shell without adequate validation, enabling a remote attacker to specify a target by MAC ahttps://patchthecve.com/cve/CVE-2025-46121.htmlhttps://patchthecve.com/cve/CVE-2025-46121.htmlWed, 17 Jun 2026 09:25:57 +0000CRITICAL 9.8: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions `stamgr_cfg_adpt_addStaFavourite` and `stamgr_cfg_adpt_addStaIot` pass a client hostname directly to snprintf as the format string. A remote attacker can exploit this flaw either byhttps://patchthecve.com/cve/CVE-2025-46120.htmlhttps://patchthecve.com/cve/CVE-2025-46120.htmlWed, 17 Jun 2026 09:25:57 +0000CRITICAL 9.8: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where a path-traversal flaw in the web interface lets the server execute attacker-supplied EJS templates outside permitted directories, allowing a remohttps://patchthecve.com/cve/CVE-2025-46119.htmlhttps://patchthecve.com/cve/CVE-2025-46119.htmlWed, 17 Jun 2026 09:25:57 +0000MEDIUM 6.3: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where an authenticated request to the management endpoint `/admin/_cmdstat.jsp` discloses the administrator password in a trivially reversible obfuscathttps://patchthecve.com/cve/CVE-2025-46118.htmlhttps://patchthecve.com/cve/CVE-2025-46118.htmlWed, 17 Jun 2026 09:25:57 +0000MEDIUM 5.3: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139 and in Ruckus ZoneDirector prior to 10.5.1.0.279, where hard-coded credentials for the ftpuser account provide FTP access to the controller, enabling a remote attacker to upload or retrieve arbitrary fihttps://patchthecve.com/cve/CVE-2025-46117.htmlhttps://patchthecve.com/cve/CVE-2025-46117.htmlWed, 17 Jun 2026 09:25:57 +0000CRITICAL 9.1: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where a hidden debug script `.ap_debug.sh` invoked from the restricted CLI does not properly sanitize its input, allowing an authenticated attacker to https://patchthecve.com/cve/CVE-2025-46116.htmlhttps://patchthecve.com/cve/CVE-2025-46116.htmlWed, 17 Jun 2026 09:25:56 +0000HIGH 8.8: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where an authenticated attacker can disable the passphrase requirement for a hidden CLI command `!v54!` via a management API call and then invoke it to