CVE-2025-67304
Last modified
CVE-2025-67304 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user. In the default configuration, the PostgreSQL service is accessible over the network on TCP port 5432. EPSS estimates a 0.48% chance of exploitation in the next 30 days.
Description
In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user. In the default configuration, the PostgreSQL service is accessible over the network on TCP port 5432. An attacker can use the hardcoded credentials to authenticate remotely, gaining superuser access to the database. This allows creation of administrative users for the web interface, extraction of password hashes, and execution of arbitrary OS commands.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Commscope | Ruckus Network Director | < 4.5.0.56 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-67304?
How severe is CVE-2025-67304?
How do I fix CVE-2025-67304?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-6729The PayMaster for WooCommerce plugin for WordPress is vulner…6.4
- CVE-2025-67290A stored cross-site scripting (XSS) vulnerability in the Pag…6.1
- CVE-2025-67291A stored cross-site scripting (XSS) vulnerability in the Med…6.1
- CVE-2025-67298An issue in ClasroomIO before v.0.2.6 allows a remote attack…8.1
- CVE-2025-6730The Bonanza – WooCommerce Free Gifts Lite plugin for WordPre…4.3
- CVE-2025-67303An issue in ComfyUI-Manager prior to version 3.38 allowed re…7.5
- CVE-2025-67305In RUCKUS Network Director (RND) < 4.5.0.56, the OVA applian…9.8
- CVE-2025-6731A vulnerability was found in yzcheng90 X-SpringBoot up to 5.…6.3
- CVE-2025-67315Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
- CVE-2025-67316An issue in realme Internet browser v.45.13.4.1 allows a rem…5.4
- CVE-2025-6732A vulnerability was found in UTT HiPER 840G up to 3.1.1-1903…8.8
- CVE-2025-67325Unrestricted file upload in the hotel review feature in QloA…9.8
Are you affected by CVE-2025-67304?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST