PT-2020-13774 · Ruckus Wireless · Ruckus Wireless Unleashed

Published 2020-07-28 · Updated 2020-07-29 · CVE-2020-13913

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ruckus Wireless Unleashed versions 200.7.10.102.92 and earlier

Description A remote attacker can execute JavaScript code via an unauthenticated crafted HTTP request due to an XSS issue in emfd. This affects various Ruckus Wireless Unleashed devices, including C110, E510, H320, H510, M510, R320, R310, R500, R510, R600, R610, R710, R720, R750, T300, T301n, T301s, T310c, T310d, T310n, T310s, T610, T710, and T710s.

Recommendations For versions 200.7.10.102.92 and earlier, consider disabling the emfd service until a patch is available to prevent exploitation of the XSS issue. Restrict access to the affected devices to minimize the risk of exploitation. Avoid using the affected devices for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-13913

Affected Products

Ruckus Wireless Unleashed

References · 4

• https://osv.dev/vulnerability/CVE-2020-13913 · Vendor Advisory
• https://support.ruckuswireless.com/security_bulletins/304 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13913 · Security Note
• https://t.me/cibsecurity/13698 · Telegram Post