9.8Kritik
KEV
CVE-2023-25717Multiple Ruckus Wireless Products CSRF and RCE Vulnerability
Aktif olarak istismar ediliyor — Multiple Ruckus Wireless Products CSRF and RCE Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 12.05.2023 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 02.06.2023.
Gerekli işlem: Apply updates per vendor instructions or disconnect product if it is end-of-life. https://support.ruckuswireless.com/security_bulletins/315; https://nvd.nist.gov/vuln/detail/CVE-2023-25717
Açıklama
Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.
Zayıflık türü (CWE):
CWE-94
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| commscope | ruckus smartzone firmware | < 5.2.1.3 | |
| ruckuswireless | ruckus wireless admin | ≤ 10.4 | |
| ruckuswireless | smartzone ap | < 6.1.0.0.9240 |
Kaynaklar ve yamalar
- https://support.ruckuswireless.com/security_bulletins/315 PatchProductVendor Advisory
- https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-… ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-25717 US Government Resource
CPE eşleşmeleri (NVD) (15)
cpe:2.3:a:ruckuswireless:ruckus_wireless_admin:*:*:*:*:*:*:*:*≤ 10.4cpe:2.3:o:ruckuswireless:smartzone_ap:*:*:*:*:*:*:*:*< 6.1.0.0.9240cpe:2.3:a:ruckuswireless:ruckus_wireless_admin:*:*:*:*:*:*:*:*≤ 10.4cpe:2.3:o:ruckuswireless:smartzone_ap:*:*:*:*:*:*:*:*< 5.2.2.0.2064cpe:2.3:a:ruckuswireless:ruckus_wireless_admin:*:*:*:*:*:*:*:*≤ 10.4cpe:2.3:o:ruckuswireless:smartzone_ap:*:*:*:*:*:*:*:*< 3.6.2.0.795cpe:2.3:a:ruckuswireless:ruckus_wireless_admin:*:*:*:*:*:*:*:*≤ 10.4cpe:2.3:o:ruckuswireless:smartzone_ap:*:*:*:*:*:*:*:*< 6.1.1.0.1274cpe:2.3:a:ruckuswireless:ruckus_wireless_admin:*:*:*:*:*:*:*:*≤ 10.4cpe:2.3:o:commscope:ruckus_smartzone_firmware:*:*:*:*:*:*:*:*< 5.2.1.3cpe:2.3:a:ruckuswireless:ruckus_wireless_admin:*:*:*:*:*:*:*:*≤ 10.4cpe:2.3:o:commscope:ruckus_smartzone_firmware:6.1.0.0.935:*:*:*:*:*:*:*cpe:2.3:a:ruckuswireless:ruckus_wireless_admin:*:*:*:*:*:*:*:*≤ 10.4cpe:2.3:a:ruckuswireless:ruckus_wireless_admin:*:*:*:*:*:*:*:*≤ 10.4cpe:2.3:o:commscope:ruckus_smartzone_firmware:*:*:*:*:*:*:*:*< 5.2.1.3.1695