Ruckus Network Director Password Storage Vulnerability

A vulnerability exists in Ruckus Network Director (RND) versions prior to 4.5, where passwords are stored in a recoverable format. RND encrypts passwords using a hardcoded weak secret key, allowing them to be decrypted and accessed in plaintext. This issue could lead to unauthorized access if the server is compromised.

Impact

Exploitation of this vulnerability could result in the exposure of all plaintext passwords stored by RND, allowing an attacker to decrypt them and potentially gain unauthorized access to RND-managed environments.

Remediation

Ruckus has released patches for Network Director version 3.0, 4.0, and 4.5. Users are advised to upgrade to these versions.