Commscope vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-67305 In RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user.Critical 9.8 · Feb 19, 2026
• CVE-2025-67304 In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user.Critical 9.8 · Feb 19, 2026
• CVE-2023-45992 A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote, unauthenticated attackeCritical 9.6 · Oct 19, 2023
• CVE-2022-45701 Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature.High 8.8 · Feb 17, 2023
• CVE-2022-27002 Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddns、ddns_host parameters.Critical 9.8 · Mar 15, 2022
• CVE-2022-27001 Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter.Critical 9.8 · Mar 15, 2022
• CVE-2022-27000 Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the h_primary_ntp_server, h_backup_ntp_sCritical 9.8 · Mar 15, 2022
• CVE-2022-26999 Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wan_ip_stat, wan_mask_stat, wan_gw_sCritical 9.8 · Mar 15, 2022
• CVE-2022-26998 Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wps_enrolee_pin parameter.Critical 9.8 · Mar 15, 2022
• CVE-2022-26997 Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the upnp function via the upnp_ttl parameter.Critical 9.8 · Mar 15, 2022
• CVE-2022-26996 Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pppoe function via the pppoe_username, pppoe_passwd, and pppoe_servicenaCritical 9.8 · Mar 15, 2022
• CVE-2022-26995 Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pptp (wan_pptp.html) function via the pptp_fix_ip, pptp_fix_mask, pptp_fCritical 9.8 · Mar 15, 2022
• CVE-2021-41552 CommScope SURFboard SBG6950AC2 9.1.103AA23 devices allow Command Injection.High 8.8 · Feb 15, 2022
• CVE-2021-20119 The password change utility for the Arris SurfBoard SB8200 can have safety measures bypassed that allow any logged-in user to change the administrator password.High 7.1 · Nov 9, 2021
• CVE-2021-20120 The administration web interface for the Arris Surfboard SB8200 lacks any protections against cross-site request forgery attacks.High 8.8 · Oct 21, 2021
• CVE-2021-33221 An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.Critical 9.8 · Jul 7, 2021
• CVE-2021-33220 An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.High 7.8 · Jul 7, 2021
• CVE-2021-33219 An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.Critical 9.8 · Jul 7, 2021
• CVE-2021-33218 An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.Critical 9.8 · Jul 7, 2021
• CVE-2021-33217 An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.High 8.8 · Jul 7, 2021
• CVE-2021-33216 An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.Critical 9.8 · Jul 7, 2021
• CVE-2020-26879 Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py.Critical 9.8 · Oct 26, 2020
• CVE-2020-26878 Ruckus through 1.5.1.0.21 is affected by remote command injection.High 8.8 · Oct 26, 2020
• CVE-2020-8830 CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA-1 field on the WireHigh 8.8 · May 5, 2020
• CVE-2020-7983 A CSRF issue in login.asp on Ruckus R500 3.4.2.0.384 devices allows remote attackers to access the panel or conduct SSRF attacks.High 8.1 · May 5, 2020