CVE-2023-45992

CRITICAL EPSS 43.6%

Published Oct 19, 20232y ago · Modified Jun 17, 20262w ago

9.6 CVSS 3.1

Critical

Published Oct 19, 2023 2y ago

Last Modified Jun 17, 2026 2w ago

Description

A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote, unauthenticated attacker to execute persistent XSS and CSRF attacks against a user of the admin management interface. A successful attack, combined with a certain admin activity, could allow the attacker to gain full admin privileges on the exploited system.

CVSS Details

Base Score

9.6

Exploitability

2.8

Impact

6.0

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction Required

Scope Changed

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

43.6% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 2

CWE-352 Cross-Site Request Forgery (CSRF) Authentication

CWE-79 Cross-site Scripting Injection

Affected Products 1

Vendor	Product	Version	Range
commscope	ruckus_cloudpath_enrollment_system	*	≤5.12.5538

References 5

ruckus.com http://ruckus.com

Not Applicable
github.com https://github.com/harry935/CVE-2023-45992

ExploitThird Party Advisory
server.cloudpath https://server.cloudpath/

Broken Link
server.cloudpath https://server.cloudpath/admin/enrollmentData/

Broken Link
support.ruckuswireless.com https://support.ruckuswireless.com/security_bulletins/322

Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.