ClosedPatched

Ruckus Wireless Multiple Products: CSRF and RCE (CVE-2023-25717)

Ruckus Wireless Multiple Products

Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs. Added to CISA KEV on 2023-05-12.

Why this severity: CVSS 9.8 (NVD), actively exploited (CISA KEV)

Started: May 12, 2023
Closed: May 12, 2023
CVE: CVE-2023-25717

Follow this incident

Updated May 12, 2023

Affected

See vendor advisory / CISA notes (versions not always listed in KEV feed)

Fixed in

See vendor advisory linked in sources

Timeline1

May 12, 2023
CISA added CVE-2023-25717 to the KEV catalog (due 2023-06-02).

Advisories3

Notes & caveats

Derived from CISA KEV JSON feed catalogVersion 2026.10.21. Exact affected/fixed version strings are not always in the KEV record — verify against the vendor advisory URL. startedAt uses dateAdded (exploitation may have begun earlier).

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified