PT-2021-20087 · Commscope · Commscope Ruckus Iot Controller

Jim Becher + 1 · Published 2021-07-07 · Updated 2021-07-09 · CVE-2021-33217

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CommScope Ruckus IoT Controller versions 1.7.1.0 and earlier

Description An issue in the Web Application of the CommScope Ruckus IoT Controller allows authenticated users to perform arbitrary read/write actions. The API endpoint allows an HTTP POST request to write arbitrary content into any file on the filesystem with root privileges.

Recommendations For CommScope Ruckus IoT Controller versions 1.7.1.0 and earlier, consider restricting access to the API endpoint that allows arbitrary file writes until a patch is available. As a temporary workaround, limit the privileges of authenticated users to prevent them from performing arbitrary read/write actions on the filesystem.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-33217

Affected Products

Commscope Ruckus Iot Controller

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-33217 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33217 · Vendor Advisory
• https://korelogic.com/advisories.html · Note
• http://seclists.org/fulldisclosure/2021/May/77 · Note