High severity · published Oct 13, 2017
CVE-2017-6224
Ruckus Wireless Zone Director Controller firmware releases ZD9.x, ZD10.0.0.x, ZD10.0.1.x (less than 10.0.1.0.17 MR1 release) and Ruckus Wireless Unleashed AP Firmware releases…
8.8
CVSS
1.2%
EPSS
No
On KEV
Description
Ruckus Wireless Zone Director Controller firmware releases ZD9.x, ZD10.0.0.x, ZD10.0.1.x (less than 10.0.1.0.17 MR1 release) and Ruckus Wireless Unleashed AP Firmware releases 200.0.x, 200.1.x, 200.2.x, 200.3.x, 200.4.x. contain OS Command Injection vulnerabilities that could allow local authenticated users to execute arbitrary privileged commands on the underlying operating system by appending those commands in the Common Name field in the Certificate Generation Request.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UF
Unleashed Firmware · Ruckuswireless
200.1; 200.1.9.12.55; 200.3; 200.3.9.13.228; 200.4.9.13; 200.4.9.13.47 · source: NVD
ZF
Zonedirector Firmware · Ruckuswireless
zd9.9.0.0.205; zd9.9.0.0.212; zd9.9.0.0.216; zd9.10.0.0.218; zd9.13.0.0.103; zd9.13.0.0.209 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-6224
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-6224
Third Party Advisory
https://ruckus-www.s3.amazonaws.com/pdf/security/faq-security-advisory-id-092917.txt
More from Unleashed Firmware
9.8
CVE-2020-13919
emfd/libemf in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to achieve command injection via a crafted HTTP request
9.8
CVE-2020-13917
rkscli in Ruckus Wireless Unleashed through 200.7.10.92 allows a remote attacker to achieve command injection and jailbreak the CLI via a crafted CLI command
9.8
CVE-2020-13916
A stack buffer overflow in webs in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to execute code via an unauthenticated crafted HTTP request
7.5
CVE-2020-13918
Incorrect access control in webs in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to leak system information (that can be used for a jailbreak) via an…
7.5
CVE-2020-13915
Insecure permissions in emfd/libemf in Ruckus Wireless Unleashed through 200.7.10.102.92 allow a remote attacker to overwrite admin credentials via an unauthenticated crafted HTTP…