How severe is CVE-2025-44958?

CVE-2025-44958 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over local access with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2025-44958 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-44958?

CVE-2025-44958 affects Commscope Ruckus Network Director. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-44958?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-44958 have an EU (EUVD) identifier?

Yes. CVE-2025-44958 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-23511.

When was CVE-2025-44958 published?

CVE-2025-44958 was published on 2025-08-04 and last updated on 2026-06-17.

CVE-2025-44958

CVE-2025-44958 is a medium-severity vulnerability in Commscope Ruckus Network Director with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-257.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (27th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-23511
Weakness: CWE-257
Affected product: Commscope Ruckus Network Director
Published: 2025-08-04
Last modified: 2026-06-17

Description

RUCKUS Network Director (RND) before 4.5 stores passwords in a recoverable format.

Frequently asked questions

What is CVE-2025-44958?: RUCKUS Network Director (RND) before 4.5 stores passwords in a recoverable format.
How severe is CVE-2025-44958?: CVE-2025-44958 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over local access with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2025-44958 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-44958?: CVE-2025-44958 affects Commscope Ruckus Network Director. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-44958?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-44958 have an EU (EUVD) identifier?: Yes. CVE-2025-44958 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-23511.
When was CVE-2025-44958 published?: CVE-2025-44958 was published on 2025-08-04 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:commscope:ruckus_network_director:*:*:*:*:*:*:*:*

More vulnerabilities in Commscope Ruckus Network Director

CVE-2025-44961 — Critical (CVSS 9.9): In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided…
CVE-2025-67305 — Critical (CVSS 9.8): In RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user. These…
CVE-2025-67304 — Critical (CVSS 9.8): In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL…
CVE-2025-44963 — Critical (CVSS 9.0): RUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded…
CVE-2025-44955 — High (CVSS 8.8): RUCKUS Network Director (RND) before 4.5 allows jailed users to obtain root access vis a weak, hardcoded password.
CVE-2025-44960 — High (CVSS 8.5): RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route.

All CVEs affecting Commscope Ruckus Network Director →

Other CWE-257 vulnerabilities

CVE-2025-8095 — Critical (CVSS 9.1): The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform. It has been identified as…
CVE-2025-8904 — High (CVSS 8.5): Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/…
CVE-2025-34180 — High (CVSS 8.4): NetSupport Manager < 14.12.0001 relies on a shared Gateway Key for authentication between Manager/Control, Client,…
CVE-2025-6996 — High (CVSS 8.4): Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update…
CVE-2025-6995 — High (CVSS 8.4): Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update…
CVE-2016-15058 — High (CVSS 8.1): Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior…

Browse all CWE-257 vulnerabilities →