CVE-2019-19843: Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a…

Critical severity · published Jan 22, 2020

CVE-2019-19843

Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a…

9.8

CVSS

1.8%

EPSS

On KEV

Description

Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a symlink with /tmp and web/user/wps_tool_cache.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.8% · higher than 79% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Unleashed · Ruckuswireless

before 200.7.10.202.94 · source: NVD

Zonedirector 1200 Firmware · Ruckuswireless

before 9.10.2.0.84; 9.12.0 before 9.12.3.0.136; 9.13.0 before 10.0.1.0.90; 10.1.0 before 10.1.2.0.275; 10.2.0 before 10.2.1.0.147; 10.3.0 before 10.3.1.0.21 · source: NVD

Affected product

Unleashed

Ruckuswireless

All Unleashed CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-19843

CVE.org

https://www.cve.org/CVERecord?id=CVE-2019-19843

Exploit

https://alephsecurity.com/2020/01/14/ruckus-wireless

Third Party Advisory

https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html

Vendor Advisory

https://www.ruckuswireless.com/security/299/view/txt