Commscope
15 CVEs across 96 Commscope products. Browse Commscope vulnerabilities, severities, and proof-of-concept exploits.
Commscope products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-67305 | Critical | 9.8 | 2026-02-19 | In RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user. These keys are identical across all deploymen… |
CVE-2025-67304 | Critical | 9.8 | 2026-02-19 | In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user. In the default configura… |
CVE-2025-44963 | Critical | 9.0 | 2025-08-04 | RUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key. |
CVE-2025-44962 | Medium | 5.0 | 2025-08-04 | RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows ../ directory traversal to read files. |
CVE-2025-44961 | Critical | 9.9 | 2025-08-04 | In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user. |
CVE-2025-44960 | High | 8.5 | 2025-08-04 | RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route. |
CVE-2025-44958 | Medium | 5.3 | 2025-08-04 | RUCKUS Network Director (RND) before 4.5 stores passwords in a recoverable format. |
CVE-2025-44957 | High | 8.5 | 2025-08-04 | Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build allows authentication bypass via a valid API key and crafted HTTP headers. |
CVE-2025-44954 | Critical | 9.0 | 2025-08-04 | RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account. |
CVE-2025-44955 | High | 8.8 | 2025-08-04 | RUCKUS Network Director (RND) before 4.5 allows jailed users to obtain root access vis a weak, hardcoded password. |
CVE-2025-46123 | High | 7.2 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where the… |
CVE-2025-46122 | Critical | 9.1 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API endpoint `/admin/_cm… |
CVE-2025-46121 | Critical | 9.8 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions `stamgr_cfg_adpt_addStaFavourite` and `s… |
CVE-2025-46120 | Critical | 9.8 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where a pa… |
CVE-2025-46119 | Medium | 6.3 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where an a… |
CVE-2025-46118 | Medium | 5.3 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139 and in Ruckus ZoneDirector prior to 10.5.1.0.279, where hard-… |
CVE-2025-46117 | Critical | 9.1 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where a hi… |
CVE-2025-46116 | High | 8.8 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where an a… |
CVE-2024-23618 | Critical | 9.6 | 2024-01-26 | An arbitrary code execution vulnerability exists in Arris SURFboard SGB6950AC2 devices. An unauthenticated attacker can exploit this vulnerability to achieve c… |
CVE-2023-49225 | Medium | 6.1 | 2023-12-07 | A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). If this vulnerability is exploited, an arbi… |
CVE-2023-45992 | Critical | 9.6 | 2023-10-19 | A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote, unauthenticated attack… |
CVE-2023-27572 | Medium | 6.1 | 2023-04-15 | An issue was discovered in CommScope Arris DG3450 Cable Gateway AR01.02.056.18_041520_711.NCS.10. A reflected XSS vulnerability was discovered in the https_red… |
CVE-2023-27571 | Medium | 5.3 | 2023-04-15 | An issue was discovered in DG3450 Cable Gateway AR01.02.056.18_041520_711.NCS.10. The troubleshooting_logs_download.php log file download functionality does no… |
CVE-2022-45701 | High | 8.8 | 2023-02-17 | Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature. |
CVE-2023-25717 | Critical | 9.8 | 2023-02-13 | Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=adm… |
CVE-2022-27002 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddns、ddns_host parameters… |
CVE-2022-27001 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter. This vulnerability allows at… |
CVE-2022-27000 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the h_primary_ntp_server, h_backup_ntp_… |
CVE-2022-26999 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wan_ip_stat, wan_mask_stat, wan_gw_… |
CVE-2022-26998 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wps_enrolee_pin parameter. This vulnerabil… |
CVE-2022-26997 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the upnp function via the upnp_ttl parameter. This vulnerability allows att… |
CVE-2022-26996 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pppoe function via the pppoe_username, pppoe_passwd, and pppoe_servicen… |
CVE-2022-26995 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pptp (wan_pptp.html) function via the pptp_fix_ip, pptp_fix_mask, pptp_… |
CVE-2021-41552 | High | 8.8 | 2022-02-15 | CommScope SURFboard SBG6950AC2 9.1.103AA23 devices allow Command Injection. |
CVE-2021-20119 | High | 7.1 | 2021-11-09 | The password change utility for the Arris SurfBoard SB8200 can have safety measures bypassed that allow any logged-in user to change the administrator password. |
CVE-2021-20120 | High | 8.8 | 2021-10-21 | The administration web interface for the Arris Surfboard SB8200 lacks any protections against cross-site request forgery attacks. This means that an attacker c… |
CVE-2021-33221 | Critical | 9.8 | 2021-07-07 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Unauthenticated API Endpoints. |
CVE-2021-33220 | High | 7.8 | 2021-07-07 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. Hard-coded API Keys exist. |
CVE-2021-33219 | Critical | 9.8 | 2021-07-07 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded Web Application Administrator Passwords for the admin and… |
CVE-2021-33218 | Critical | 9.8 | 2021-07-07 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded System Passwords that provide shell access. |
CVE-2021-33217 | High | 8.8 | 2021-07-07 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The Web Application allows Arbitrary Read/Write actions by authenticated users… |
CVE-2021-33216 | Critical | 9.8 | 2021-07-07 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. An Undocumented Backdoor exists, allowing shell access via a developer account. |
CVE-2021-33215 | Medium | 4.3 | 2021-07-07 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The API allows Directory Traversal. |
CVE-2020-26879 | Critical | 9.8 | 2020-10-26 | Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by… |
CVE-2020-26878 | High | 8.8 | 2020-10-26 | Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API (/service/v1/createUser endpoint), injec… |
CVE-2020-8830 | High | 8.8 | 2020-05-05 | CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA-1 field on the Wir… |
CVE-2020-8033 | Medium | 6.1 | 2020-05-05 | Ruckus R500 3.4.2.0.384 devices allow XSS via the index.asp Device Name field. |
CVE-2020-7983 | High | 8.1 | 2020-05-05 | A CSRF issue in login.asp on Ruckus R500 3.4.2.0.384 devices allows remote attackers to access the panel or conduct SSRF attacks. |
CVE-2020-9476 | High | 7.5 | 2020-03-04 | ARRIS TG1692A devices allow remote attackers to discover the administrator login name and password by reading the /login page and performing base64 decoding. |
CVE-2019-15806 | Critical | 9.8 | 2019-08-29 | CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they i… |
CVE-2019-15805 | Critical | 9.8 | 2019-08-29 | CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they i… |
CVE-2018-20386 | Critical | 9.8 | 2018-12-23 | ARRIS SBG6580-2 D30GW-SEAEAGLE-1.5.2.5-GA-00-NOSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4… |
CVE-2018-20383 | Critical | 9.8 | 2018-12-23 | ARRIS DG950A 7.10.145 and DG950S 7.10.145.EURO devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1… |
CVE-2018-17555 | High | 7.5 | 2018-09-26 | The web component on ARRIS TG2492LG-NA 061213 devices allows remote attackers to obtain sensitive information via the /snmpGet oids parameter. |
CVE-2018-10990 | High | 8.0 | 2018-05-14 | On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not immediately destroy all state on the device related to the validity o… |
CVE-2018-10989 | Medium | 6.6 | 2018-05-14 | Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of "password" for the admin account that is u… |
CVE-2017-16836 | Medium | 6.1 | 2017-11-16 | Arris TG1682G devices with Comcast TG1682_2.0s7_PRODse 10.0.59.SIP.PC20.CT software allow Unauthenticated Stored XSS via the actionHandler/ajax_managed_service… |
CVE-2017-14117 | Medium | 5.9 | 2017-09-03 | The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service… |
CVE-2017-14116 | High | 8.1 | 2017-09-03 | The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG599 device, when IP Passthrough mode is not used, configures WAN access to a caserver https service with… |
CVE-2017-14115 | High | 8.1 | 2017-09-03 | The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures ssh-permanent-enable WAN SSH log… |
CVE-2017-10793 | High | 8.1 | 2017-09-03 | The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589, NVG599, and unspecified other devices, when IP Passthrough mode is not used, configures an sbdc.ha W… |
CVE-2017-9521 | Critical | 9.8 | 2017-07-31 | The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r204217… |
CVE-2017-9492 | High | 7.5 | 2017-07-31 | The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r204217… |
CVE-2017-9491 | Medium | 5.3 | 2017-07-31 | The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r204217… |
CVE-2017-9490 | High | 8.8 | 2017-07-31 | The Comcast firmware on Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices allows configuration changes… |
CVE-2017-9489 | High | 8.8 | 2017-07-31 | The Comcast firmware on Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST) devices allows configuration changes via CSRF. |
CVE-2017-9476 | Medium | 6.5 | 2017-07-31 | The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r204217… |
CVE-2014-3778 | | 2014-06-19 | Multiple cross-site request forgery (CSRF) vulnerabilities in goform/RgDdns in ARRIS (formerly Motorola) SBG901 SURFboard Wireless Cable Modem allow remote att… |