Medium severity · published Dec 7, 2023
CVE-2023-49225
A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo)
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in the product. As for the affected products/models/versions, see the information provided by the vendor listed under [References] section or the list under [Product Status] section.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
AP Solo C110 · CommScope, Inc.
114.0.0.0.6565 and earlier · source: vendor
AS
AP Solo E510 · CommScope, Inc.
114.0.0.0.6565 and earlier · source: vendor
AS
AP Solo H320 · CommScope, Inc.
114.0.0.0.6565 and earlier · source: vendor
AS
AP Solo H350 · CommScope, Inc.
116.0.0.0.3128 and earlier · source: vendor
AS
AP Solo H510 · CommScope, Inc.
114.0.0.0.6565 and earlier · source: vendor
AS
AP Solo H550 · CommScope, Inc.
116.0.0.0.1506 and earlier · source: vendor
AS
AP Solo M510 · CommScope, Inc.
114.0.0.0.6565 and earlier · source: vendor
AS
AP Solo R310 · CommScope, Inc.
110.0.0.0.2014 and earlier · source: vendor
AS
AP Solo R320 · CommScope, Inc.
114.0.0.0.6565 and earlier · source: vendor
AS
AP Solo R350 · CommScope, Inc.
116.0.0.0.1655 and earlier · source: vendor
AS
AP Solo R510 · CommScope, Inc.
114.0.0.0.6565 and earlier · source: vendor
AS
AP Solo R550 · CommScope, Inc.
114.0.0.0.5585 and earlier · source: vendor