PT-2017-16952 · Ruckus Wireless · Ruckus Wireless Zone Director Controller+1

Publicado 2017-10-13 · Atualizado 2019-10-03 · CVE-2017-6224

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ruckus Wireless Zone Director Controller firmware versions ZD9.x through ZD10.0.1.x (less than 10.0.1.0.17 MR1 release) Ruckus Wireless Unleashed AP Firmware versions 200.0.x through 200.4.x

Description The issue allows local authenticated users to execute arbitrary privileged commands on the underlying operating system. This is achieved by appending commands in the Common Name field in the Certificate Generation Request.

Recommendations For Ruckus Wireless Zone Director Controller firmware versions ZD9.x through ZD10.0.1.x (less than 10.0.1.0.17 MR1 release), update to version 10.0.1.0.17 MR1 release or later. For Ruckus Wireless Unleashed AP Firmware versions 200.0.x through 200.4.x, update to a version later than 200.4.x. As a temporary workaround, consider restricting access to the Certificate Generation Request feature until a patch is available.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2017-6224

Produtos afetados

Ruckus Wireless Unleashed Ap Firmware

Ruckus Wireless Zone Director Controller

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-6224 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6224 · Nota de Segurança
• https://ruckus-www.s3.amazonaws.com/pdf/security/faq-security-advisory-id-092917.txt · Nota