Introduction
Attackers can gain root-level access to enterprise wireless management systems by exploiting a single hardcoded SSH key. This flaw affects Ruckus SmartZone (SZ) platforms, which are widely used to manage wireless infrastructure in schools, hospitals, and large organizations.
Ruckus Networks is a leading wireless networking vendor owned by CommScope, with products deployed in critical sectors including education, healthcare, and smart cities. Their SmartZone controllers are central to managing thousands of access points and hundreds of thousands of clients, making any compromise highly consequential for operational security and data privacy.
Technical Information
CVE-2025-44954 is a critical vulnerability in Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build. The root cause is the presence of a hardcoded SSH private key for a root-equivalent user account. This key pair is stored in the /home/$USER/.ssh/ directory and is identical across all installations of the affected software. The vulnerability is classified under CWE-1394 (Use of Default Cryptographic Key).
An attacker who obtains the private key from any instance of the affected product can use it to authenticate as a privileged user on any other vulnerable device. This bypasses all standard authentication mechanisms and grants full administrative control, including the ability to:
- Change configurations
- Exfiltrate sensitive data
- Deploy malicious firmware or software
- Move laterally within the network
The vulnerability affects both Virtual SmartZone (vSZ) and Network Director (RND) products. The risk is highest in environments where management interfaces are exposed to untrusted networks or the internet.
No public code snippets or proof of concept are available for this vulnerability.
Detection Methods
Detecting unauthorized access resulting from hardcoded default SSH keys in Ruckus vSZ devices involves several proactive measures:
1. File System Inspection:
- Locate Default SSH Keys:
- Examine the
/home/$USER/.ssh/directory for the presence of default public and private RSA keys.
- Examine the
2. Network Traffic Analysis:
- Monitor SSH Access:
- Analyze network logs for SSH login attempts, especially those originating from unexpected IP addresses or occurring at unusual times.
3. System Log Review:
- Audit User Activities:
- Review system logs to identify any unauthorized user activities or anomalies that could indicate exploitation of the vulnerability.
4. Vulnerability Scanning:
- Utilize Security Tools:
- Employ vulnerability scanners to detect the presence of default SSH keys and assess the system's exposure to this specific issue.
5. Configuration Management:
- Verify User Accounts:
- Ensure that no built-in users have root-equivalent privileges without proper authorization.
6. Implement Monitoring Solutions:
- Set Up Alerts:
- Configure monitoring tools to alert administrators of any unauthorized SSH access attempts or changes to critical system files.
By systematically applying these detection methods, administrators can identify and mitigate unauthorized access stemming from hardcoded default SSH keys in Ruckus vSZ devices.
Reference: Tenable CVE-2025-44954
Affected Systems and Versions
- Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build
- Virtual SmartZone (vSZ) all versions prior to 6.1.2p3 Refresh Build
- Network Director (RND) products prior to corresponding patched releases
Any deployment running these versions with default configurations is vulnerable. The risk is especially high if management interfaces are accessible from untrusted networks.
Vendor Security History
Ruckus Networks has previously faced similar issues involving hardcoded credentials and delayed responses to critical vulnerabilities. The initial lack of response to coordinated disclosure of CVE-2025-44954, followed by eventual patch releases, indicates ongoing challenges in their vulnerability management and customer communication processes. Security researchers and industry observers have noted these patterns in prior incidents as well.
References
- NVD entry for CVE-2025-44954
- MITRE CVE entry
- Claroty Team82 Disclosure Dashboard
- CERT/CC VU#613753
- Tenable CVE-2025-44954
- HelpNetSecurity: Ruckus network management solutions riddled with unpatched vulnerabilities
- GB Hackers: Critical Ruckus Wireless Flaws
- Field Effect: Ruckus Networks Flaws
- SecurityWeek: Unpatched Ruckus Vulnerabilities