Medium severity · published Mar 26, 2026
CVE-2021-4474
Ruckus AP CLI Arbitrary File Read Allows Authenticated Remote File Access
4.9
CVSS
0.5%
EPSS
No
On KEV
Description
Ruckus Access Point products contain an arbitrary file read vulnerability in the command-line interface that allows authenticated remote attackers with administrative privileges to read arbitrary files from the underlying filesystem. Attackers can exploit this vulnerability to access sensitive information including configuration files, credentials, and system data stored on the device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
RUCKUS Access Point · Ruckus Wireless
0 · source: vendor
RU
RUCKUS Unleashed · Ruckus
0 · source: vendor
S1
SmartZone 100 (SZ-100) (EOL) · Ruckus
0 · source: vendor
S1
SmartZone 100-D (SZ100-D) (EOL) · Ruckus
0 · source: vendor
S1
SmartZone 144 (SZ-144) · Ruckus
0 · source: vendor
S1
SmartZone 144-Dataplane (SZ144-D) · Ruckus
0 · source: vendor
S3
SmartZone 300 (SZ300) (EOL) · Ruckus
0 · source: vendor
Z1
ZoneDirector 1200 (EOL) · Ruckus
0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-4474
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-4474
support.ruckuswireless.com
https://support.ruckuswireless.com/security_bulletins/306
www.vulncheck.com
https://www.vulncheck.com/advisories/ruckus-ap-cli-arbitrary-file-read-allows-authenticated-remote-file-access
