CVE-2023-49225 json
A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo).
published 2023-12-07 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-53228
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 35%
- public exploits
- 0
- none known
Summary
A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in the product. As for the affected products/models/versions, see the information provided by the vendor listed under [References] section or the list under [Product Status] section.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected products
- CommScope, Inc. ZoneDirector
- CommScope, Inc. SmartZone
- CommScope, Inc. AP Solo R750
- CommScope, Inc. AP Solo R650
- CommScope, Inc. AP Solo R730
- CommScope, Inc. AP Solo T750
- CommScope, Inc. AP Solo R550
- CommScope, Inc. AP Solo R850
- CommScope, Inc. AP Solo T750SE
- CommScope, Inc. AP Solo R510
- CommScope, Inc. AP Solo T310D
- CommScope, Inc. AP Solo E510
- CommScope, Inc. AP Solo C110
- CommScope, Inc. AP Solo R320
- CommScope, Inc. AP Solo H510
- CommScope, Inc. AP Solo H320
- CommScope, Inc. AP Solo T310S
- CommScope, Inc. AP Solo T310N
- CommScope, Inc. AP Solo T310C
- CommScope, Inc. AP Solo T305
- CommScope, Inc. AP Solo M510
- CommScope, Inc. AP Solo R720
- CommScope, Inc. AP Solo R710
- CommScope, Inc. AP Solo T710
- CommScope, Inc. AP Solo T710s
- CommScope, Inc. AP Solo T610
- CommScope, Inc. AP Solo T610s
- CommScope, Inc. AP Solo R610
- CommScope, Inc. AP Solo R310
- CommScope, Inc. AP Solo R760
- CommScope, Inc. AP Solo R560
- CommScope, Inc. AP Solo H550
- CommScope, Inc. AP Solo H350
- CommScope, Inc. AP Solo T350c
- CommScope, Inc. AP Solo T350d
- CommScope, Inc. AP Solo T350se
- CommScope, Inc. AP Solo R350
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
support.ruckuswireless.com
/security_bulletins/323
patch, vendor-advisory
-
jvn.jp
/en/jp/JVN45891816/
third-party-advisory
Sources
- CVE List CVE-2023-49225
- NVD CVE-2023-49225
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.