CVE-2025-44961 Command injection in SmartZone

What is CVE-2025-44961?

CVE-2025-44961 is a critical command injection vulnerability in RUCKUS SmartZone, published on 4 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user.

Weakness: CWE-78

Which versions are affected by CVE-2025-44961?

It affects 2 products.

Products include Commscope Ruckus Network Director, Commscope Ruckus Smartzone Firmware.

How do I fix CVE-2025-44961?

No fix has been published for CVE-2025-44961 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-44961 being exploited?

There is no known exploitation of CVE-2025-44961 in the wild and no public exploit code.

Other vulnerabilities in RUCKUS SmartZone

• CVE-2025-67304 Hardcoded credentials in n/a Critical 9.8
• CVE-2025-67305 Hardcoded credentials in n/a Critical 9.8
• CVE-2025-44963 Hardcoded credentials in Network Director Critical 9.0
• CVE-2025-44955 Hardcoded credentials in Network Director High 8.8
• CVE-2025-44957 Auth bypass in SmartZone High 8.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pxq8-xx7h-h878.