CVE-2025-44954
📋 TL;DR
RUCKUS SmartZone network controllers before version 6.1.2p3 Refresh Build contain a hardcoded SSH private key for a root-equivalent account, allowing attackers with network access to authenticate as root without credentials. This affects all organizations running vulnerable SmartZone software versions. The vulnerability enables complete system compromise.
💻 Affected Systems
- RUCKUS SmartZone (SZ) network controllers
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with root access, allowing installation of persistent backdoors, data exfiltration, network pivoting, and disruption of wireless network services.
Likely Case
Unauthorized root access leading to configuration changes, credential harvesting, and lateral movement within the network infrastructure.
If Mitigated
Limited impact if network segmentation restricts access to management interfaces and SSH is disabled on external interfaces.
🎯 Exploit Status
Exploitation requires only the hardcoded private key and SSH access to the management interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.1.2p3 Refresh Build or later
Vendor Advisory: https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e
Restart Required: Yes
Instructions:
1. Download the patch from RUCKUS support portal. 2. Backup current configuration. 3. Apply the patch following vendor instructions. 4. Restart the SmartZone controller. 5. Verify SSH keys have been regenerated.
🔧 Temporary Workarounds
Disable SSH access
linuxDisable SSH service on management interfaces to prevent exploitation
# Disable SSH service
systemctl stop sshd
systemctl disable sshd
Network segmentation
linuxRestrict network access to SmartZone management interfaces using firewall rules
# Example iptables rule to restrict SSH access
iptables -A INPUT -p tcp --dport 22 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
🧯 If You Can't Patch
- Isolate SmartZone controllers from untrusted networks using firewall rules
- Implement strict network segmentation and monitor for SSH authentication attempts
🔍 How to Verify
Check if Vulnerable:
Check SSH authorized_keys file for hardcoded public key or verify version is below 6.1.2p3 Refresh BuildCheck Version:
show version | grep "SmartZone"Verify Fix Applied:
Verify version is 6.1.2p3 Refresh Build or later and check that SSH keys have been regenerated📡 Detection & Monitoring
Log Indicators:
- SSH authentication attempts using the hardcoded key
- Unexpected root login events
- Configuration changes from unknown sources
Network Indicators:
- SSH connections to SmartZone management interfaces from unexpected sources
- Unusual outbound connections from SmartZone controllers
SIEM Query:
source="smartzone" AND (event="ssh_login" AND user="root") OR (event="configuration_change" AND actor!="authorized_user")