ruckus/RuckusCountryCodeChange

[giscus[bot]]

ruckus/RuckusCountryCodeChange

Hackery

https://ms264556.net/ruckus/RuckusCountryCodeChange

[yorickdowne]

Amazing, thank you! US to PT is my exact situation. While I can run the APs in US domain here in PT, it somehow feels better to set them to PT instead.

[squozeneu]

I am confused with a T750 that I just got. I removed the country code according to the support logs:

Fixed Ctry Code: no

Yet when I try to set my country code to Ireland in my group of 3 APs, the T750 cannot download the configuration. It works fine when I set the group to US. What am I missing?

[ms264556]

Maybe check you haven't disabled all of the permitted-outdoors channels?
I think Ireland has a quite limited selection of outdoor 5 GHz channels: 100-136 (DFS required); whereas US also allows 36-64 & 149-161.
You could try temporarily enabling "Allow Indoor Channels" and see if that helps?

Otherwise, feel free to privately send me details of your controller/version & the logs at STH or Reddit.

[squozeneu]

Enabling indoor channels did indeed solve it, so that gives me something to work on. Thanks!

[squozeneu]

And I think it was some kind of corrupted config, because after I got it successfully connected I could turn indoor channels back off and it continued working. Roaming between APs works seamlessly - very happy!

[squozeneu]

Ah, spoke too soon. I added my R650 back to the group and the T750 started falling over again. I am thinking I need to blow the entire network config away and start from scratch....

[squozeneu]

And I think I've worked it out - I was ticking the 'use 5.8Ghz channels' box and I don't have a licence for that. When I reset all the channels for the 18th time and left that box unchecked I can see all three access points connected.

[squozeneu]

And again, if I turn off 'use indoor channels' and reconnect the T750, it fails to retrieve the config. I guess I log a bug with Ruckus.

[Nyanchovy]

Wanting to change the country code on my US locked R710, I downgraded to R710_200.6.10.1.312.bl7 and ran the "rbd country 0" which seemed to go as shown. However now in the web gui my country code dropdown is empty and my device name is blank. I can't change the firmware either! I've tried a factory reset but no-go. Any ideas what I could try next to 'unbrick' this so to speak?

[ms264556]

With an ancient release like 200.6 it's essential that you use Firefox. Random stuff will not work properly with Chrome/Edge including the firmware upgrade process

[ms264556]

(I don't recommend installing an Unleashed release that old for any reason).

[Nyanchovy]

Thanks for the reply! After unlocking the region, I crawled my way to 200.7.10.2.339 via ssh and tftp, now at least I can get into the GUI with Firefox. I'm trying an upgrade to the latest version, It's sort of just sat there now so I'll leave it 10 minutes and see if it does anything.

[ms264556]

I can update the instructions if they're unclear, but you could've just downgraded to 200.14.6.1.199 then applied the "option 2" patch.

Also, you could use tftp to re-upgrade directly to the latest release

[Nyanchovy]

Yep, I wasn't sure how far back I had to go to get that command line business working, that's totally on me. Updating the documents for bright-sparks like me wouldn't be a bad idea :-) I think R710_200.15.6.212.20.bl7 is the latest for the R710 so I'll give that a go via ssh/tftp, wish me luck!

Thanks for documenting how to get these US units out of the region-lock, by the way, I'm sure my neighbors will appreciate me setting an AU channel, going forward lol.

[zanechua]

Hey @ms264556

We can now exploit this for the newer Unleashed firmware prior to:

• 200.15.6.212.27
• 200.18.7.1.323

See: https://sector7.computest.nl/post/2025-07-ruckus-unleashed/

I think the easiest one to use would be CVE-2025-46116 where we just disable the cli password check. I've tested this on a Ruckus R770, running the earliest unleashed firmware available 200.16.7.0.402.

curl -k 'https://unleashed.ruckuswireless.com/admin/_conf.jsp' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-raw $'<ajax-request action='setconf' updater='system.ts' comp='system'>
        <clipwd enabled='false' x-ruckus-vendor-code='' ruckus-vendor-code=''/>
      </ajax-request>'

then it's just a matter of running !v54! per the exploit instructions and subsequently following the unlock steps here.

I tried using the .ap_debug.sh script exploit which was CVE-2025-46117 but I think that requires a valid unleashed network setup which you wouldn't be able to do in setup mode.

[zanechua]

@ms264556

I noticed you have switched to a different exploit now such that it uses a script?

Is it possible to include the old directions, perhaps in your older procedures page?

https://ms264556.net/ruckus/UnleashedAddRootShellOtherMethods

I don't mind documenting it on my own but rather have it all in one place

[ms264556]

Sure. I'll add it to the other page. The !v54! exploit didn't work reliably when I tested against a wide range of Unleashed releases, so I reverted to a script which did work reliably.

I don't really see a problem with copy-pasting a script into your shell vs pasting a single command... either way, you copy-paste into your shell, and the AP is rooted.

[zanechua]

I see.

I trust that your instructions as well as the script doesn't do any malicious actions but for security conscious folks, we would have to take the time out to validate it.

As opposed to just a curl command which is much simpler to understand what it does.

[ms264556]

Agreed. Unfortunately, having a reliable procedure was more important to me in the end (since I'm the guy who gets emails when it doesn't work). Do note that many of my other scripts and patches are similarly pre-packaged for convenience, always with instructions for 'checking my workings'.

I'll add the curl command details when I have a minute, with a note that it doesn't always work. Then everyone will be happy.

[zanechua]

Yeah I totally understand that.

Thank you for all your hard work. Happy to buy you a beer or two if there's
a link somewhere I can contribute.

[mikegleasonjr]

I am about to buy a Ruckus US00 but I live in Europe, what's the best from the 3 options, and what firmware version should I install first. I believe it is already on Unleashed, but I don't know the version yet. Thanks!

[mikegleasonjr]

*Ruckus R550

[ms264556]

The first option is by far the easiest, and should work with whatever firmware is installed.

[mikegleasonjr]

Oh amazing, and it will survive powerloss?

[ms264556]

Yes. Power loss, factory reset, firmware upgrades.

[mikegleasonjr]

Ok thank you very much, may it help someone else too!

[weijersnetwerken]

For anyone wondering if this’ll work on Access Network AP’s, i can confirm this works on Access Networks AP’s (A350 & A550). Even cheaper than “regular” US AP’s. Identical hardware, just different branding in the Unleashed UI. And afaik you can’t connect with Zonedirector (correct me if I’m wrong).

Even though the CLI has a different name (ANUC) everything worked fine. The only error was:
error in opening cli_session_timeout File, Default timeout 900sec will be set

Maybe we can use this in conjunction with the R730 -> R850 conversion (or something similar) so the A350 can become a R350 (ruckus branding and compatibility with zonedirector etc)?

[ms264556]

Yes, Access Networks and Rivi APs run vanilla Ruckus firmware, with a little bit of branding applied.

You should be fine to connect to a ZoneDirector, assuming it's running 10.5.1 firmware: Access Networks actually sold rebranded ZoneDirectors.

If the branding bothers you then you can remove it from a root shell:-

(1) Backup your Unleashed config.
(2) get a root shell: https://ms264556.net/ruckus/UnleashedAddRootShell
(3) remove branding:

rm -f /writable/etc/airespider-images/unleashed_oem
rkscli -c 'set factory'
reboot

(4) Re-upgrade your firmware
(5) Restore from your backup if the upgrade didn't already do this for you.

Unleashed uses the existence of Access Networks branding to decide whether to enable its OvrC agent, so if you're using OvrC then you'll have to leave the branding alone.

[weijersnetwerken]

One of our external colleagues told me it wouldn't work (and I didn’t bother to try it) but that’s debunked haha 😉

I’m changing the branding tomorrow. Nice to have. Thanks again! 😊

[NatShaw]

Great doc! I’m interested in this part: ‘The real set countrycode NZ would have set this rpmkey, but also fixed up the wifi channels. We're not running the fixup code, so it's safest to do a factory reset now’

Does that mean the set country code command would enable the country channels immediately (eg 12/13 on 2.4 outside USA) and that the rpmkey-only method needs the reboot, but you’ll still get those channels?

[ms264556]

Does that mean the set country code command would enable the country channels immediately (eg 12/13 on 2.4 outside USA) and that the rpmkey-only method needs the reboot, but you’ll still get those channels?

Yeah, set countrycode has extra programming to trigger an immediate recalculation of available channels. I recommend a full factory reset in the guide because that reliably forces a recalculation of available channels.

If you're going to subsequently apply a firmware upgrade (e.g. by connecting to a different version of SmartZone / R1 / Unleashed) then the extra factory reset probably isn't necessary. But I know it's very stressful following an online guide for unfamiliar tech, so I generally favour a few extra steps vs forcing the reader to make decisions.