An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139 and in Ruckus ZoneDirector prior to 10.5.1.0.279, where hard-coded credentials for the ftpuser account provide FTP access to the controller, enabling a remote attacker to upload or retrieve arbitrary files from writable firmware directories and thereby expose sensitive information or compromise the controller.
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
| Link | Tags |
|---|---|
| https://support.ruckuswireless.com/security_bulletins/330 | product |
| https://sector7.computest.nl/post/2025-07-ruckus-unleashed/ | third party advisory exploit |