Introduction
A single RUCKUS SmartZone controller can manage up to 10000 access points and 150000 clients. A critical vulnerability in this platform puts large-scale enterprise, education, healthcare, and municipal Wi-Fi deployments worldwide at risk. In July 2025, security researchers uncovered nine critical flaws in RUCKUS management products. One of the most severe, CVE-2025-44960, lets authenticated attackers execute arbitrary operating system commands through a vulnerable API parameter.
About RUCKUS Networks: RUCKUS, a subsidiary of CommScope, is a major enterprise wireless networking vendor. Its SmartZone product line is widely deployed in high-density environments such as universities, hospitals, hotels, and public infrastructure. These controllers run large networks from a central point, so a flaw in their management interfaces has an outsized effect on the organizations that depend on them and on their users.
Technical information
CVE-2025-44960 is an OS command injection vulnerability affecting RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build. SmartZone does not properly sanitize a specific API parameter. When an authenticated user submits crafted input to this parameter, SmartZone passes it unsanitized to an underlying operating system command. The attacker can then inject arbitrary commands, which run with the privileges of the SmartZone management application. The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command).
The attack vector is remote and requires authenticated access to the affected API route. Public advisories have not disclosed the exact parameter or API route. Neither the researchers nor the vendor has released public code snippets or a proof of concept. An attacker can chain this vulnerability with other flaws, such as authentication bypass or hardcoded secrets, which raises the risk of exploitation in real-world scenarios.
Affected systems and versions
- RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build is vulnerable
- All deployments running versions prior to 6.1.2p3 Refresh Build are affected
- The vulnerability is present in both physical and virtual SmartZone appliances
- Only systems with management API access exposed are at risk
Vendor security history
RUCKUS Networks has had security issues in its management products before. In July 2025, Claroty Team82 disclosed nine critical vulnerabilities, including authentication bypass, hardcoded secrets, arbitrary file read, and OS command injection. The vendor was slow to respond to the coordinated disclosure, and there were multiple reports of communication problems and delayed patches. RUCKUS and its parent company CommScope need better security processes and faster response times.
