PT-2018-8324 · Ruckus Networks · Zonedirector+1

Published 2018-02-14 · Updated 2018-03-12 · CVE-2017-6229

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ruckus Networks Unleashed AP firmware versions prior to 200.6.10.1.x Ruckus Networks Zone Director firmware versions 10.1.0.0.x, 9.10.2.0.x, 9.12.3.0.x, 9.13.3.0.x, 10.0.1.0.x

Description The issue concerns an authenticated Root Command Injection in the Command Line Interface (CLI) that could allow authenticated valid users to execute privileged commands on the respective systems.

Recommendations For Ruckus Networks Unleashed AP firmware, update to version 200.6.10.1.x or later. For Ruckus Networks Zone Director firmware versions 10.1.0.0.x, 9.10.2.0.x, 9.12.3.0.x, 9.13.3.0.x, 10.0.1.0.x, update to a version later than the specified ones.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2017-6229

Affected Products

Ruckus Unleashed

Zonedirector

References · 3

• https://osv.dev/vulnerability/CVE-2017-6229 · Vendor Advisory
• https://ruckus-www.s3.amazonaws.com/pdf/security/faq-security-advisory-id-20180202-v1.0.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6229 · Security Note