CVE-2025-46118

Executive Summary

CVE-2025-46118 is a critical security vulnerability affecting CommScope Ruckus Unleashed and ZoneDirector wireless controllers. The flaw involves hard-coded credentials for the ftpuser account, which are identical across all installations. An unauthenticated, remote attacker can leverage these credentials to access the FTP service running on the controller. This access allows the attacker to upload or retrieve arbitrary files from writable firmware directories, leading to full compromise of the controller, exposure of sensitive configuration data, and potential lateral movement within the network.

The vulnerability is trivial to exploit, requiring only network access to the controller's FTP port (typically TCP 21). No authentication bypass or complex chaining is needed. Given the widespread deployment of Ruckus equipment in enterprise, education, and hospitality environments, this vulnerability poses a significant risk to network infrastructure.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in embedded network appliances. However, the hard-coded credentials could be used to tamper with firmware updates or configuration files, potentially introducing malicious code into the supply chain of the affected devices.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network - The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low - No special conditions or complex attack sequences are required.
• Privileges Required (PR): None - The attacker does not need any prior authentication.
• User Interaction (UI): None - No user action is required for exploitation.
• Scope (S): Unchanged - The impact is confined to the vulnerable component.
• Confidentiality (C): High - Full read access to the filesystem, including configuration files with passwords and keys.
• Integrity (I): High - Full write access to writable directories, allowing modification of firmware and configuration.
• Availability (A): High - An attacker could upload malicious files that crash the controller or render it inoperable.

Threat Level: Critical. The combination of remote exploitability, no authentication required, and full system compromise makes this a top-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability resides in the FTP server component of the Ruckus Unleashed and ZoneDirector firmware. The ftpuser account is created with a static, hard-coded password that is identical across all devices running the same firmware version. This account is intended for internal maintenance but is exposed on the network interface.

Mechanics:

1. Discovery: An attacker scans for devices with FTP port 21 open and identifies them as Ruckus controllers via banner grabbing or other fingerprinting.
2. Authentication: The attacker connects to the FTP service and logs in using the known hard-coded credentials (ftpuser / [hard-coded password]). The exact password is not publicly disclosed in the CVE description but is discoverable through firmware analysis.
3. File Operations: Once authenticated, the attacker has read/write access to specific writable directories on the controller's filesystem (e.g., /tmp, /var/run, or firmware staging areas).
4. Exploitation: The attacker can:
   • Read configuration files (/etc/config/wlan, /data/config.xml) to extract Wi-Fi passwords, RADIUS secrets, and management credentials.
   • Upload a malicious firmware image or script to a writable directory, then trigger its execution (e.g., via a reboot or by exploiting another vulnerability).
   • Download log files to gather intelligence on network activity.

The root cause is a violation of the principle of least privilege and the use of static credentials. The FTP service should either be disabled by default, require SSH key-based authentication, or use dynamically generated, device-specific passwords.

Vulnerable vs. Patched Code

The vulnerability is not in a specific code function but in the presence of a hard-coded credential in the firmware's configuration or initialization scripts.

Vulnerable (Pre-Patch): The /etc/passwd or equivalent file contains an entry for ftpuser with a static password hash. The FTP daemon (likely vsftpd or similar) is configured to allow this user to log in from any network interface.

# Example of vulnerable configuration (conceptual)
# /etc/passwd
ftpuser:$1$static$hash:1001:1001:FTP User:/var/ftp:/bin/false

Patched (Post-Patch): The patched firmware removes the ftpuser account entirely or changes the authentication mechanism to require SSH keys or a dynamically generated token. The FTP service may also be restricted to localhost only.

# Example of patched configuration (conceptual)
# /etc/passwd - ftpuser entry removed
# FTP service bound to 127.0.0.1 only
# /etc/vsftpd.conf
listen_address=127.0.0.1

The patch also likely includes a mechanism to generate a unique password for the ftpuser account during initial setup, stored in a secure, non-volatile location.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Environment:

• A virtualized or physical Ruckus Unleashed controller running a vulnerable version (e.g., 200.15.6.212.13).
• Attacker machine (Kali Linux) on the same network segment.

Exploitation Steps:

1. Scan for Target:

   nmap -p 21 --script banner <target_ip>
   

2. Connect via FTP:

   ftp <target_ip>
   # Name: ftpuser
   # Password: <hard-coded_password>  (e.g., "ruckus123" - this is an example, actual password is different)
   

3. Explore and Extract Data:

   ftp> ls
   ftp> cd /data
   ftp> get config.xml
   ftp> get wlan_config.txt
   

4. Upload Malicious Payload:

   ftp> put malicious_firmware.bin /tmp/firmware_update.bin
   ftp> put exploit_script.sh /var/run/exploit.sh
   

5. Trigger Execution (if possible):

   • If the FTP user has write access to a cron directory or a startup script directory, the attacker can schedule the malicious script to run.
   • Alternatively, the attacker could overwrite a legitimate firmware file and trigger a reboot.

Note: The exact hard-coded password is not provided in the CVE description. Red teamers would need to obtain it through firmware reverse engineering or from private vulnerability disclosures.

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor FTP Logs: Check for successful logins by the ftpuser account from unexpected IP addresses.

   # On the controller (if accessible)
   grep "ftpuser" /var/log/vsftpd.log
   

2. Network Monitoring: Look for FTP traffic (TCP/21) to/from the controller, especially from non-administrative IP ranges.

3. File Integrity Monitoring: Monitor for changes to critical configuration files (/data/config.xml, /etc/config/) and firmware directories.

4. Honeypot: Deploy a fake FTP service on the same port to alert on any connection attempts using the ftpuser account.

Mitigation Steps:

• Immediately upgrade to the patched firmware versions.
• If patching is not possible, restrict FTP access to the controller using a firewall (allow only from trusted management IPs).
• Disable the FTP service entirely if not required.
• Change the ftpuser password (if the firmware allows it) to a strong, unique value.

Indicators of Compromise (IOCs)

• Network IOCs:

  • FTP connections (TCP/21) to the controller from unusual external IPs.
  • FTP login attempts with the username ftpuser.
  • Large file transfers to/from the controller via FTP (e.g., downloading config.xml or uploading firmware images).

• File System IOCs:

  • Presence of unexpected files in /tmp, /var/run, or /data directories.
  • Modified timestamps on critical configuration files.
  • New user accounts or SSH keys added to the system.

• Log IOCs:

  • Successful FTP login events for ftpuser in /var/log/vsftpd.log or messages.
  • Reboot events not initiated by an administrator.

Detection Engineering

YARA Rule

rule CVE_2025_46118_Ruckus_Hardcoded_FTP {
    meta:
        description = "Detects files containing hard-coded ftpuser credentials in Ruckus firmware"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46118"
        hash = "unknown"
    strings:
        $ftp_user = "ftpuser"
        $ftp_pass = /ftpuser:[^:]+:[^:]+:[^:]+:[^:]+:[^:]+:[^:]+/
        $config_ref = "config.xml"
    condition:
        $ftp_user and $ftp_pass and $config_ref
}

Sigma Rule

title: Detection of FTP Login with Hardcoded ftpuser Account
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects successful FTP login attempts using the hard-coded ftpuser account on Ruckus controllers.
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-46118
logsource:
    product: linux
    service: vsftpd
detection:
    selection:
        EventID: 'FTP Login Successful'
        User: 'ftpuser'
    condition: selection
falsepositives:
    - Legitimate administrative use if the account is intentionally enabled and monitored.
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"CVE-2025-46118 Ruckus FTP Hardcoded Credentials Attempt"; flow:to_server,established; content:"USER ftpuser"; nocase; content:"PASS "; within:100; reference:cve,2025-46118; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade all Ruckus Unleashed controllers to version 200.15.6.212.14 or 200.17.7.0.139, and all ZoneDirector controllers to version 10.5.1.0.279 or later.
2. Firewall: Block inbound FTP (TCP/21) access to the controllers from untrusted networks. Allow only from dedicated management IPs.
3. Disable FTP: If FTP is not required for operations, disable the service entirely via the controller's web interface or CLI.

Long-Term Measures:

• Implement network segmentation to isolate management interfaces of network appliances.
• Use SSH with key-based authentication for all administrative access.
• Regularly audit device configurations for hard-coded credentials or default accounts.
• Subscribe to vendor security advisories for timely patch notifications.

Valters IT
Securing your digital frontier.