High severity · published Feb 14, 2018
CVE-2017-6230
Ruckus Networks Solo APs firmware releases R110.x or before and Ruckus Networks SZ managed APs firmware releases R5.x or before contain authenticated Root Command Injection in the…
8.8
CVSS
2.3%
EPSS
No
On KEV
Description
Ruckus Networks Solo APs firmware releases R110.x or before and Ruckus Networks SZ managed APs firmware releases R5.x or before contain authenticated Root Command Injection in the web-GUI that could allow authenticated valid users to execute privileged commands on the respective systems.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Smartzone Managed Access Point Firmware · Ruckuswireless
through r5.0 · source: NVD
SA
Solo Access Point Firmware · Ruckuswireless
through r110.0 · source: NVD
Affected product
SM
Smartzone Managed Access Point Firmware
Ruckuswireless