Ruckus Network Director

In RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user. These keys are identical across all deployments, allowing an attacker with network access to authenticate via SSH without a password. Once authenticated, the attacker can access the PostgreSQL database with superuser privileges, create administrative users for the web interface, and potentially escalate privileges further.

Published: 2026-02-19T00:00:00.000Z
Updated: 2026-02-23T14:06:57.026Z

In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user. In the default configuration, the PostgreSQL service is accessible over the network on TCP port 5432. An attacker can use the hardcoded credentials to authenticate remotely, gaining superuser access to the database. This allows creation of administrative users for the web interface, extraction of password hashes, and execution of arbitrary OS commands.

Published: 2026-02-19T00:00:00.000Z
Updated: 2026-02-23T14:03:21.884Z

RUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key.

Published: 2025-08-04T00:00:00.000Z
Updated: 2025-11-03T20:04:21.203Z

RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows ../ directory traversal to read files.

Published: 2025-08-04T00:00:00.000Z
Updated: 2025-11-03T20:04:19.843Z

In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user.

Published: 2025-08-04T00:00:00.000Z
Updated: 2025-11-03T20:04:18.408Z