CVE-2025-44963

The vulnerability results from the use of a static, hardcoded secret key value (CWE-321) used to sign JWT (JSON Web Token) tokens. Since the key is identical across all product installations, an attacker who learns this value can independently generate a properly signed JWT token with administrator role. Such a token will be accepted by the application as authentic, allowing the authentication mechanism to be bypassed. The attack requires no privileges, victim interaction, or account access — the only condition is knowledge of the hardcoded key.

An attacker can gain full administrative control over RUCKUS Network Director, which in practice means the ability to modify network configuration, take over managed network devices, and potentially perform further lateral movement within the infrastructure. Due to the scope (S:C), the impact may extend beyond the RND system itself.

Update RUCKUS Network Director to version 4.5 or later as soon as possible, in which the hardcoded JWT key has been replaced with a unique, random secret. Details are available in the official Commscope security notice (Security Advisory ID 20250710) and in the CERT/CC database VULS#613753.

Commscope RUCKUS Network Director (RND) in all versions prior to 4.5.