CVE-2025-67305

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-67305
In RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user. These keys are identical across all deployments, allowing an attacker with network access to authenticate via SSH without a password. Once authenticated, the attacker can access the PostgreSQL database with superuser privileges, create administrative users for the web interface, and potentially escalate privileges further.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-012-ruckus-nd-hardcoded-ssh-keys-rce.md Exploit Third Party Advisory
https://webresources.commscope.com/download/assets/RUCKUS+Network+Director%3A+Critical+Security+Bypass+Vulnerability+Leading+to+Remote+Code+Execution+and/3adeb3acb69211f08a46b6532db37357 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:commscope:ruckus_network_director:*:*:*:*:*:*:*:*
History

03 Apr 2026, 11:34

Type Values Removed Values Added
First Time Commscope ruckus Network Director
Commscope
CPE cpe:2.3:a:commscope:ruckus_network_director:*:*:*:*:*:*:*:*
Summary
  • (es) En RUCKUS Network Director (RND) &lt; 4.5.0.56, el dispositivo OVA contiene claves SSH almacenadas en el código para el usuario postgres. Estas claves son idénticas en todas las implementaciones, permitiendo a un atacante con acceso a la red autenticarse a través de SSH sin una contraseña. Una vez autenticado, el atacante puede acceder a la base de datos PostgreSQL con privilegios de superusuario, crear usuarios administradores para la interfaz web y, potencialmente, escalar más privilegios.
References () https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-012-ruckus-nd-hardcoded-ssh-keys-rce.md - () https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-012-ruckus-nd-hardcoded-ssh-keys-rce.md - Exploit, Third Party Advisory
References () https://webresources.commscope.com/download/assets/RUCKUS+Network+Director%3A+Critical+Security+Bypass+Vulnerability+Leading+to+Remote+Code+Execution+and/3adeb3acb69211f08a46b6532db37357 - () https://webresources.commscope.com/download/assets/RUCKUS+Network+Director%3A+Critical+Security+Bypass+Vulnerability+Leading+to+Remote+Code+Execution+and/3adeb3acb69211f08a46b6532db37357 - Vendor Advisory

23 Feb 2026, 14:16

Type Values Removed Values Added
CWE CWE-321
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

19 Feb 2026, 21:18

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-19 21:18

Updated : 2026-04-03 11:34

NVD link : CVE-2025-67305

Mitre link : CVE-2025-67305

CVE.ORG link : CVE-2025-67305

JSON object : View

Products Affected

commscope

  • ruckus_network_director
CWE
CWE-321

Use of Hard-coded Cryptographic Key