CVE-2025-67305
Critical
Description
In RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user. These keys are identical across all deployments, allowing an attacker with network access to authenticate via SSH without a password. Once authenticated, the attacker can access the PostgreSQL database with superuser privileges, create administrative users for the web interface, and potentially escalate privileges further.
SeverityCritical
CVSS9.8
Exploit probability—
ProductCommscope Ruckus Network Director
PublishedFeb 19, 2026
First seenFeb 19, 2026
Weakness typeCWE-321CWE-321
How to fix
Update
- commscope ruckus_network_director4.5.0.56 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| commscope ruckus_network_director | v < 4.5.0.56 | 4.5.0.56 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.