RUCKUS SmartZone (SZ) versions prior to 6.1.2p3 Refresh Build contain an OS command injection vulnerability via a parameter in an API route. This vulnerability allows an attacker with low privileges to execute arbitrary operating system commands remotely without user interaction. The flaw has a high severity score of 8.5 and impacts confidentiality, integrity, and availability of the affected system.