What is the CVSS score of CVE-2025-67304?

CVE-2025-67304 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PostgreSQL are affected by CVE-2025-67304?

Ruckus Network Director appliances contain hardcoded database credentials that are exposed over the network, allowing unauthenticated attackers to gain complete control of the network management…

How to fix or mitigate CVE-2025-67304?

Within 24 hours: Inventory all Ruckus Network Director deployments and their versions; immediately restrict network access to PostgreSQL port 5432 at the firewall and segment RND appliances from untrusted networks. Within 7 days: Implement continuous network monitoring for port 5432 access attempts; document business criticality of each RND instance. Within 30 days: Upgrade all RND instances to version 4.5.0.54 or later when patch becomes available; perform forensic review for unauthorized database access.

PostgreSQL CVE-2025-67304

CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-02-19 cve@mitre.org

Authentication Bypass PostgreSQL

9.8

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

CVE Published

Feb 19, 2026 - 20:25 nvd

CRITICAL 9.8

DescriptionNVD

In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user. In the default configuration, the PostgreSQL service is accessible over the network on TCP port 5432. An attacker can use the hardcoded credentials to authenticate remotely, gaining superuser access to the database. This allows creation of administrative users for the web interface, extraction of password hashes, and execution of arbitrary OS commands.

AnalysisAI

Hardcoded PostgreSQL credentials in Ruckus Network Director OVA < 4.5.0.54.

Technical ContextAI

CWE-798 hardcoded database credentials in OVA appliance.

RemediationAI

Update to 4.5.0.54.

CVE-2025-67304 vulnerability details – vuln.today

Back

PostgreSQL CVE-2025-67304

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code