CVE-2023-49225

mediumpriority · track · 24EPSS 0.004 · 36 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.41% (36th) EPSS

CVSS 6.1 · medium

Is it mine?

74 products

Check your exposure

Who says so?

2 sources

cnnvd · enisa_euvd

EPSS · scored 2026-10-27

A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in the product. As for the affected products/models/versions, see the information provided by the vendor listed under [References] section or the list under [Product Status] section.

cvss

Technical severity, 0–10. One row per scoring source.

6.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 2.7

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · ENISA EU

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondaryexploitability 2.8 · impact 2.7

v3.15.6mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USprimary

affected products (74)

Products and version ranges known to be affected.

CommScope, Inc. AP Solo C110≤ 114.0.0.0.6565 and earlierenisa_euvdEU
CommScope, Inc. AP Solo E510≤ 114.0.0.0.6565 and earlierenisa_euvdEU
CommScope, Inc. AP Solo H320≤ 114.0.0.0.6565 and earlierenisa_euvdEU
CommScope, Inc. AP Solo H350≤ 116.0.0.0.3128 and earlierenisa_euvdEU
CommScope, Inc. AP Solo H510≤ 114.0.0.0.6565 and earlierenisa_euvdEU
CommScope, Inc. AP Solo H550≤ 116.0.0.0.1506 and earlierenisa_euvdEU
CommScope, Inc. AP Solo M510≤ 114.0.0.0.6565 and earlierenisa_euvdEU
CommScope, Inc. AP Solo R310≤ 110.0.0.0.2014 and earlierenisa_euvdEU
CommScope, Inc. AP Solo R320≤ 114.0.0.0.6565 and earlierenisa_euvdEU
CommScope, Inc. AP Solo R350≤ 116.0.0.0.1655 and earlierenisa_euvdEU
CommScope, Inc. AP Solo R510≤ 114.0.0.0.6565 and earlierenisa_euvdEU
CommScope, Inc. AP Solo R550≤ 114.0.0.0.5585 and earlierenisa_euvdEU
CommScope, Inc. AP Solo R560≤ 118.1.0.0.1908 and earlierenisa_euvdEU
CommScope, Inc. AP Solo R610≤ 114.0.0.0.6565 and earlierenisa_euvdEU
CommScope, Inc. AP Solo R650≤ 114.0.0.0.6565 and earlierenisa_euvdEU
CommScope, Inc. AP Solo R710≤ 114.0.0.0.6565 and earlierenisa_euvdEU
CommScope, Inc. AP Solo R720≤ 114.0.0.0.6565 and earlierenisa_euvdEU
CommScope, Inc. AP Solo R730≤ 114.0.0.0.6565 and earlierenisa_euvdEU
CommScope, Inc. AP Solo R750≤ 114.0.0.0.6565 and earlierenisa_euvdEU
CommScope, Inc. AP Solo R760≤ 118.1.0.0.1274 and earlierenisa_euvdEU

showing 20 of 74

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd NVD CVE.org MITRE

published 2023-12-07modified 2026-06-17

related (53,013)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-42897US	medium6.1OT critical	70.7% (99th)	KEV	2026-05-14
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network…
CVE-2025-66376US	medium6.1OT critical	20.2% (97th)	KEV	2026-01-05
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.
CVE-2025-68461US	medium6.1OT critical	27.4% (98th)	KEV	2025-12-18
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
CVE-2025-48700US	—OT critical	1.71% (77th)	KEV	2025-06-23
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to exec…
CVE-2025-27915US	—OT critical	4.06% (91st)	KEV	2025-03-12
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient…

+53008 more

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan