PT-2018-8325 · Ruckus Networks · Ruckus Sz+1

Published 2018-02-14 · Updated 2018-03-16 · CVE-2017-6230

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ruckus Networks Solo APs versions R110.x or before Ruckus Networks SZ managed APs versions R5.x or before

Description The issue concerns an authenticated Root Command Injection in the web-GUI. This could allow authenticated valid users to execute privileged commands on the respective systems.

Recommendations For Ruckus Networks Solo APs versions R110.x or before, update to a version later than R110.x to resolve the issue. For Ruckus Networks SZ managed APs versions R5.x or before, update to a version later than R5.x to resolve the issue. As a temporary workaround, consider restricting access to the web-GUI to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2017-6230

Affected Products

Ruckus Sz

Ruckus Solo Aps

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-6230 · Security Note
• https://ruckus-www.s3.amazonaws.com/pdf/security/faq-security-advisory-id-20180202-v1.0.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6230 · Vendor Advisory