Potential CVE-2023-25717 Exploitation Attempt

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•24

Detects a potential exploitation attempt of CVE-2023-25717, a Remote Code Execution vulnerability via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin. The rule looks for specific URI query parameters including '/forms/doLogin', 'login_username', 'password', and the presence of '$(' or its URL-encoded version '%24%28', which are indicative of command injection.