Introduction
Attackers can get root-level access to enterprise wireless management systems with a single hardcoded SSH key. The flaw affects Ruckus SmartZone (SZ) platforms, which schools, hospitals, and large organizations widely use to manage their wireless infrastructure.
Ruckus Networks is a wireless networking vendor owned by CommScope. Its products are deployed in critical sectors, including education, healthcare, and smart cities. SmartZone controllers manage thousands of access points and hundreds of thousands of clients, so any compromise has serious consequences for operational security and data privacy.
Technical Information
CVE-2025-44954 is a critical vulnerability in Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build. The root cause is a hardcoded SSH private key for a root-equivalent user account. The key pair is stored in the /home/$USER/.ssh/ directory and is identical across all installations of the affected software. The vulnerability is classified under CWE-1394 (Use of Default Cryptographic Key).
An attacker who obtains the private key from any instance of the affected product can use it to authenticate as a privileged user on any other vulnerable device. This bypasses all standard authentication and gives the attacker full administrative control, including the ability to:
- Change configurations
- Exfiltrate sensitive data
- Deploy malicious firmware or software
- Move laterally within the network
The vulnerability affects both Virtual SmartZone (vSZ) and Network Director (RND) products. The risk is highest where management interfaces are exposed to untrusted networks or the internet.
No public code snippets or proof of concept are available for this vulnerability.
Detection Methods
To detect unauthorized access through the hardcoded default SSH keys on Ruckus vSZ devices, administrators can:
- Inspect the
/home/$USER/.ssh/directory for the default public and private RSA keys. - Analyze network logs for SSH login attempts, especially attempts from unexpected IP addresses or at unusual times.
- Review system logs for unauthorized user activity or anomalies that could indicate exploitation of the vulnerability.
- Run vulnerability scanners to detect the default SSH keys and assess the system's exposure to this specific issue.
- Check user accounts to confirm that no built-in user has root-equivalent privileges without proper authorization.
- Configure monitoring tools to alert administrators to unauthorized SSH access attempts or changes to critical system files.
Reference: Tenable CVE-2025-44954
Affected Systems and Versions
- Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build
- Virtual SmartZone (vSZ) all versions prior to 6.1.2p3 Refresh Build
- Network Director (RND) products prior to corresponding patched releases
Any deployment running these versions with default configurations is vulnerable. The risk is especially high if management interfaces are reachable from untrusted networks.
Vendor Security History
Ruckus Networks has had similar problems before, both with hardcoded credentials and with slow responses to critical vulnerabilities. With CVE-2025-44954, the vendor did not respond at first to coordinated disclosure and released patches only later. That sequence points to ongoing problems in how Ruckus manages vulnerabilities and communicates with customers.
References
- NVD entry for CVE-2025-44954
- MITRE CVE entry
- Claroty Team82 Disclosure Dashboard
- CERT/CC VU#613753
- Tenable CVE-2025-44954
- HelpNetSecurity: Ruckus network management solutions riddled with unpatched vulnerabilities
- GB Hackers: Critical Ruckus Wireless Flaws
- Field Effect: Ruckus Networks Flaws
- SecurityWeek: Unpatched Ruckus Vulnerabilities
