CVE-2025-46121

Executive Summary

CVE-2025-46121 is a critical format string vulnerability in CommScope Ruckus Unleashed wireless controllers. The flaw resides in the stamgr_cfg_adpt_addStaFavourite and stamgr_cfg_adpt_addStaIot functions, which pass a client-supplied hostname directly to snprintf as the format string argument. This allows a remote attacker to achieve arbitrary code execution (ACE) on the controller.

The vulnerability can be exploited in two ways:

1. Authenticated exploitation: An attacker with valid credentials sends a crafted request to the /admin/_conf.jsp endpoint.
2. Unauthenticated exploitation: An attacker spoofs the MAC address of a "favourite" station and embeds malicious format specifiers in the DHCP hostname field. This triggers format-string processing without authentication and without direct network access to the controller.

The CVSS score is 0.0 in the NVD data, but based on the technical details, this is a critical vulnerability with a likely CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The EPSS score is 0.0%, indicating no active exploitation in the wild at the time of analysis, but the attack vector is highly dangerous.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level vulnerability in CommScope Ruckus Unleashed wireless controllers. Organizations using these controllers should treat this as a critical supply chain risk, as the device is a network edge component.

CVSS Breakdown & Threat Level

Threat Level: Critical. The vulnerability allows unauthenticated remote code execution with no user interaction. An attacker can fully compromise the wireless controller, potentially pivoting to the internal network.

Deep Dive & Mechanics

The vulnerability is a classic format string bug (CWE-134). In C, snprintf is used to format a string. The first argument is the output buffer, the second is the size, and the third is the format string. If user-controlled data is passed as the format string, an attacker can use format specifiers like %x, %n, %s, etc., to read from or write to arbitrary memory locations.

In this case, the functions stamgr_cfg_adpt_addStaFavourite and stamgr_cfg_adpt_addStaIot receive a client hostname (from DHCP or from the /admin/_conf.jsp endpoint) and pass it directly to snprintf as the format string. For example:

snprintf(buffer, sizeof(buffer), hostname);

Instead of the safe version:

snprintf(buffer, sizeof(buffer), "%s", hostname);

An attacker can inject format specifiers like %x%x%x%n to write arbitrary values to memory, leading to code execution.

Attack Vectors:

1. Authenticated: The attacker sends a POST request to /admin/_conf.jsp with a malicious hostname in the sta_favourite or sta_iot parameter.
2. Unauthenticated: The attacker spoofs the MAC address of a station that is already in the "favourite" list. When the station sends a DHCP request with a malicious hostname, the controller processes it and triggers the format string vulnerability.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

void stamgr_cfg_adpt_addStaFavourite(char *hostname) {
    char buffer[256];
    snprintf(buffer, sizeof(buffer), hostname); // VULNERABLE
    // ... process buffer
}

Patched Code (Conceptual):

void stamgr_cfg_adpt_addStaFavourite(char *hostname) {
    char buffer[256];
    snprintf(buffer, sizeof(buffer), "%s", hostname); // SAFE
    // ... process buffer
}

The patch ensures that the hostname is treated as a string argument, not as a format string.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Ruckus Unleashed controller running a vulnerable version (< 200.15.6.212.14 or < 200.17.7.0.139).
• For unauthenticated exploitation: ability to spoof a MAC address and send DHCP requests on the same network segment as the controller.

Exploit (Unauthenticated):

1. Identify a "favourite" station's MAC address (e.g., via network scanning or social engineering).
2. Spoof that MAC address on your attacking machine.
3. Send a DHCP request with a malicious hostname containing format specifiers.

Example DHCP hostname payload:

%x%x%x%x%n

This will cause the controller to write to memory. A more sophisticated payload would use %n to write a specific value to a specific address, achieving code execution.

Exploit (Authenticated):

1. Obtain valid credentials (e.g., via phishing or default passwords).
2. Send a POST request to /admin/_conf.jsp with the malicious hostname.

Example using curl:

curl -X POST -d "sta_favourite=%x%x%x%x%n" -b "session=valid_session" http://controller/admin/_conf.jsp

Note: No public exploit code is available at this time. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for DHCP requests with unusual hostnames containing % characters.
• Monitor for HTTP requests to /admin/_conf.jsp with suspicious parameters.
• Deploy the YARA and Sigma rules provided in the Detection Engineering section.

Hunting:

• Search logs for format specifiers (%x, %n, %s, etc.) in DHCP hostname fields or HTTP parameters.
• Look for crashes or unexpected behavior in the controller's process logs.

Containment:

• If exploitation is suspected, isolate the controller from the network immediately.
• Review logs for signs of lateral movement.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_46121_FormatString_DHCP {
    meta:
        description = "Detects DHCP hostnames containing format string specifiers indicative of CVE-2025-46121 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46121"
    strings:
        $fmt1 = /%[0-9]*[xnsd]/ 
        $fmt2 = /%[0-9]*\$[xnsd]/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-46121 Format String Exploitation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests to /admin/_conf.jsp with format string specifiers in sta_favourite or sta_iot parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/_conf.jsp'
        cs-uri-query|contains: 
            - 'sta_favourite=%'
            - 'sta_iot=%'
    condition: selection
falsepositives:
    - Legitimate use of % in hostnames (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-46121 Format String Exploitation Attempt"; flow:to_server; content:"POST"; http_method; content:"/admin/_conf.jsp"; http_uri; content:"sta_favourite"; http_client_body; pcre:"/sta_favourite=[^&]*%[0-9]*[xnsd]/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Apply the vendor patch as soon as it becomes available. Upgrade to version 200.15.6.212.14 or 200.17.7.0.139 or later.
2. Workaround: If patching is not possible, disable the "favourite stations" and "IoT" features in the controller configuration.
3. Network Segmentation: Place the controller on a separate VLAN with strict access controls.
4. Authentication: Enforce strong passwords and multi-factor authentication for the admin interface.

Long-term:

• Implement network monitoring for DHCP anomalies.
• Regularly audit controller logs for suspicious activity.
• Subscribe to vendor security advisories.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.