PT-2017-16951 · Ruckus Wireless · Ruckus Wireless Zone Director Controller

Publicado 2017-10-13 · Atualizado 2017-10-27 · CVE-2017-6223

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ruckus Wireless Zone Director Controller firmware releases ZD9.9.x through ZD9.10.x Ruckus Wireless Zone Director Controller firmware releases ZD9.13.0.x less than 9.13.0.0.232

Description The issue concerns OS Command Injection vulnerabilities in the ping functionality. This could allow local authenticated users to execute arbitrary privileged commands on the underlying operating system.

Recommendations For ZD9.9.x through ZD9.10.x, update to a version outside of this range to resolve the issue. For ZD9.13.0.x, update to version 9.13.0.0.232 or later to resolve the issue. As a temporary workaround, consider restricting access to the ping functionality until a patch is available.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2017-6223

Produtos afetados

Ruckus Wireless Zone Director Controller

Referências · 3

• https://ruckus-www.s3.amazonaws.com/pdf/security/faq-security-advisory-id-092917.txt · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6223 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-6223 · Aviso do Fabricante