Ruckus Network Director Privilege Escalation Vulnerability via Hardcoded Password

A vulnerability in Ruckus Network Director (RND) prior to version 4.5 allows jailed users to gain root access by exploiting a weak, hardcoded password. RND includes a restricted environment for users to manage devices without full access to the operating system. However, this environment contains a built-in jailbreak that can be activated with the hardcoded password, granting root permissions on the server.

Impact

Exploitation of this vulnerability allows authenticated users to elevate privileges and gain root access on the affected RND server.

Remediation

Ruckus has released patches for this vulnerability. Users are advised to upgrade to Ruckus Network Director versions 3.0, 4.0, or 4.5. For those with a KSP applied in their SmartZone, contact Ruckus support to avoid possible KSP conflicts.