PT-2020-16526 · Ruckus · Ruckus Vriot

Published 2020-10-26 · Updated 2025-06-11 · CVE-2020-26879

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ruckus vRioT versions 1.5.1.0.21 and earlier

Description The issue concerns an API backdoor that is hardcoded into the validate token.py file. This backdoor allows an unauthenticated attacker to interact with the service API by using a specific backdoor value as the Authorization header.

Recommendations For Ruckus vRioT versions 1.5.1.0.21 and earlier, consider restricting access to the validate token.py file until a patch is available. As a temporary workaround, avoid using the backdoor value in the Authorization header to minimize the risk of exploitation.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2020-26879

Affected Products

Ruckus Vriot

References · 16

• 🔥 https://adepts.of0x.cc/ruckus-vriot-rce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-26879 · Security Note
• https://support.ruckuswireless.com/documents · Vendor Advisory
• https://support.ruckuswireless.com/security_bulletins/305 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26879 · Vendor Advisory
• https://t.me/aptreports/1158 · Telegram Post
• https://t.me/rnetsec/13635 · Telegram Post
• https://t.me/secharvester/10073 · Telegram Post
• https://twitter.com/TheXC3LL · Note
• https://t.me/cybersecuritytechnologies/1986 · Telegram Post
• https://t.me/canyoupwnme/6657 · Telegram Post
• https://x-c3ll.github.io · Note
• https://t.me/shadow_group_tg/50 · Telegram Post
• https://adepts.of0x.cc · Note
• https://twitter.com/pdnuclei_bot/status/1932754696302965130 · Twitter Post