CVE-2025-44961

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Aug 4, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-449624.3RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows ../ directory traversal to read files.CVE-2025-449638.1RUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain sCVE-2025-449643.9A lack of SSL certificate validation in BlueStacks v5.20 allows attackers to execute a man-it-the-middle attack and obtain sensitive informaCVE-2025-44977.8A vulnerability was found in code-projects Simple Banking System up to 1.0. It has been rated as critical. This issue affects some unknown pCVE-2025-44987.8A vulnerability classified as critical has been found in code-projects Simple Bus Reservation System 1.0. Affected is the function a::instalCVE-2025-44997.8A vulnerability classified as critical was found in code-projects Simple Hospital Management System 1.0. Affected by this vulnerability is tCVE-2025-449986.1A stored cross-site scripting (XSS) vulnerability in the component /tinyfilemanager.php of TinyFileManager v2.4.7 allows attackers to executCVE-2025-45007.8A vulnerability, which was classified as critical, has been found in code-projects Hotel Management System 1.0. Affected by this issue is thCVE-2025-450017.5react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaCVE-2025-450025.4Vigybag v1.0 and before is vulnerable to Cross Site Scripting (XSS) via the upload profile picture function under my profile.CVE-2025-450069.1Improper mstatus.SUM bit retention (non-zero) in Open-Source RISC-V Processor commit f517abb violates privileged spec constraints, enabling CVE-2025-450074.8A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the profile.php file of PHPGurukul Timetable Generator System v1.0. T
CVE-2025-44961: High severity, CVSS 8.8 | Vulnix