CVE-2023-45992

A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote, unauthenticated attacker to execute persistent XSS and CSRF attacks against a user of the admin management interface. A successful attack, combined with a certain admin activity, could allow the attacker to gain full admin privileges on the exploited system.

Score

CVSS 3.1 9.6 Critical

Status

Modified - cve@mitre.org

Published

2023-10-19

Last modified

2026-07-09

Weaknesses

CWE-352, CWE-79

Affected products

• Ruckus Cloudpath Enrollment System (Commscope)

References

• https://github.com/harry935/CVE-2023-45992
• https://server.cloudpath/
• https://server.cloudpath/admin/enrollmentData/
• https://support.ruckuswireless.com/security_bulletins/322