PT-2021-20092 · Commscope · Commscope Ruckus Iot Controller

Jim Becher + 1 · Published 2021-07-07 · Updated 2021-07-09 · CVE-2021-33221

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CommScope Ruckus IoT Controller versions 1.7.1.0 and earlier

Description An issue was discovered that involves Unauthenticated API Endpoints.

Recommendations For CommScope Ruckus IoT Controller versions 1.7.1.0 and earlier, consider restricting access to the API endpoints as a temporary workaround until a patch is available.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-33221

Affected Products

Commscope Ruckus Iot Controller

References · 4

• 🔥 http://seclists.org/fulldisclosure/2021/May/72 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-33221 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33221 · Vendor Advisory
• https://korelogic.com/advisories.html · Note