High severity · published Feb 14, 2018
CVE-2017-6229
Ruckus Networks Unleashed AP firmware releases before 200.6.10.1.x and Ruckus Networks Zone Director firmware releases 10.1.0.0.x, 9.10.2.0.x, 9.12.3.0.x, 9.13.3.0.x, 10.0.1.0.x…
8.8
CVSS
2.3%
EPSS
No
On KEV
Description
Ruckus Networks Unleashed AP firmware releases before 200.6.10.1.x and Ruckus Networks Zone Director firmware releases 10.1.0.0.x, 9.10.2.0.x, 9.12.3.0.x, 9.13.3.0.x, 10.0.1.0.x or before contain authenticated Root Command Injection in the CLI that could allow authenticated valid users to execute privileged commands on the respective systems.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HF
H320 Firmware · Ruckuswireless
before 200.6.10.1.0 · source: NVD
HF
H510 Firmware · Ruckuswireless
before 200.6.10.1.0 · source: NVD
RF
R310 Firmware · Ruckuswireless
before 200.6.10.1.0 · source: NVD
RF
R500 Firmware · Ruckuswireless
before 200.6.10.1.0 · source: NVD
RF
R510 Firmware · Ruckuswireless
before 200.6.10.1.0 · source: NVD
RF
R600 Firmware · Ruckuswireless
before 200.6.10.1.0 · source: NVD
RF
R710 Firmware · Ruckuswireless
before 200.6.10.1.0 · source: NVD
RF
R720 Firmware · Ruckuswireless
before 200.6.10.1.0 · source: NVD
TF
T300 Firmware · Ruckuswireless
before 200.6.10.1.0 · source: NVD
TF
T300e Firmware · Ruckuswireless
before 200.6.10.1.0 · source: NVD
TF
T301 Firmware · Ruckuswireless
before 200.6.10.1.0 · source: NVD
TF
T610 Firmware · Ruckuswireless
before 200.6.10.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-6229
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-6229
Vendor Advisory
https://ruckus-www.s3.amazonaws.com/pdf/security/faq-security-advisory-id-20180202-v1.0.txt
More from H320 Firmware
6.1
CVE-2023-49225
A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo)