CVE-2025-46121
CRITICALDescription
An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions `stamgr_cfg_adpt_addStaFavourite` and `stamgr_cfg_adpt_addStaIot` pass a client hostname directly to snprintf as the format string. A remote attacker can exploit this flaw either by sending a crafted request to the authenticated endpoint `/admin/_conf.jsp`, or without authentication and without direct network access to the controller by spoofing the MAC address of a favourite station and embedding malicious format specifiers in the DHCP hostname field, resulting in unauthenticated format-string processing and arbitrary code execution on the controller.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| ruckuswireless | ruckus_unleashed |
| ruckuswireless | ruckus_unleashed |
| ruckuswireless | ruckus_zonedirector |
| commscope | ruckus_c110 |
| commscope | ruckus_e510 |
| commscope | ruckus_h320 |
| commscope | ruckus_h350 |
| commscope | ruckus_h510 |
| commscope | ruckus_h550 |
| commscope | ruckus_m510 |
| commscope | ruckus_m510-jp |
| commscope | ruckus_r310 |
| commscope | ruckus_r320 |
| commscope | ruckus_r350 |
| commscope | ruckus_r350e |
| commscope | ruckus_r510 |
| commscope | ruckus_r550 |
| commscope | ruckus_r560 |
| commscope | ruckus_r610 |
| commscope | ruckus_r650 |
| commscope | ruckus_r670 |
| commscope | ruckus_r710 |
| commscope | ruckus_r720 |
| commscope | ruckus_r730 |
| commscope | ruckus_r750 |
| commscope | ruckus_r760 |
| commscope | ruckus_r770 |
| commscope | ruckus_r850 |
| commscope | ruckus_t310c |
| commscope | ruckus_t310n |
| commscope | ruckus_t310s |
| commscope | ruckus_t350c |
| commscope | ruckus_t350d |
| commscope | ruckus_t350se |
| commscope | ruckus_t610 |
| commscope | ruckus_t670 |
| commscope | ruckus_t710 |
| commscope | ruckus_t710s |
| commscope | ruckus_t750 |
| commscope | ruckus_t750se |
| commscope | ruckus_t811-cm |
| commscope | ruckus_t811-cm_\(non-sfp\) |
| commscope | zonedirector_1200 |
References
Frequently Asked Questions
What is CVE-2025-46121? +
How severe is CVE-2025-46121? +
What products are affected by CVE-2025-46121? +
How do I check if I'm vulnerable to CVE-2025-46121? +
Related Vulnerabilities
ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending …
Solar FTP Server fails to properly handle format strings passed to the USER command. When a specially crafted string containing …
WM Downloader version 3.1.2.2 is vulnerable to a buffer overflow when processing a specially crafted .m3u playlist file. The application …
In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. Reported by Dylan …
Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service …
SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously crafted …