CVE-2017-6224
Ruckus Wireless Zone Director Controller firmware releases ZD9.x, ZD10.0.0.x, ZD10.0.1.x (less than 10.0.1.0.17 MR1 release) and Ruckus Wir…
Published 9 y ago · modified 4 mo ago · JSON
Summary
Ruckus Wireless Zone Director Controller firmware releases ZD9.x, ZD10.0.0.x, ZD10.0.1.x (less than 10.0.1.0.17 MR1 release) and Ruckus Wireless Unleashed AP Firmware releases 200.0.x, 200.1.x, 200.2.x, 200.3.x, 200.4.x. contain OS Command Injection vulnerabilities that could allow local authenticated users to execute arbitrary privileged commands on the underlying operating system by appending those commands in the Common Name field in the Certificate Generation Request.
Exploit prediction (EPSS)
1.21% probability of exploitation in the next 30 days, higher than 69% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Affected products
- Brocade Communications Systems, Inc. Zone Director Controller and Unleashed AP Firmware
Classification
- Weakness
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
- ruckus-www.s3.amazonaws.com /pdf/security/faq-security-advisory-id-092917.txt · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-6224
- NVD: CVE-2017-6224
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.