7.5

CVE-2020-22662

In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to change and set unauthorized "illegal region code" by remote code Execution command injection which leads to run illegal frequency with maxi output power. Vulnerability allows attacker to create an arbitrary amount of ssid wlans interface per radio which creates overhead over noise (the default max limit is 8 ssid only per radio in solo AP). Vulnerability allows attacker to unlock hidden regions by privilege command injection in WEB GUI.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ruckuswireless ≫ R310 Firmware Version 10.5.1.0.199
   Ruckuswireless ≫ R310 Version -
Ruckuswireless ≫ R500 Firmware Version 10.5.1.0.199
   Ruckuswireless ≫ R500 Version -
Ruckuswireless ≫ R600 Firmware Version 10.5.1.0.199
   Ruckuswireless ≫ R600 Version -
Ruckuswireless ≫ T300 Firmware Version 10.5.1.0.199
   Ruckuswireless ≫ T300 Version -
Ruckuswireless ≫ T301n Firmware Version 10.5.1.0.199
   Ruckuswireless ≫ T301n Version -
Ruckuswireless ≫ T301s Firmware Version 10.5.1.0.199
   Ruckuswireless ≫ T301s Version -
Ruckuswireless ≫ Scg200 Firmware Version < 3.6.2.0.795
   Ruckuswireless ≫ Scg200 Version -
Ruckuswireless ≫ Sz-100 Firmware Version < 3.6.2.0.795
   Ruckuswireless ≫ Sz-100 Version -
Ruckuswireless ≫ Sz-300 Firmware Version < 3.6.2.0.795
   Ruckuswireless ≫ Sz-300 Version -
Ruckuswireless ≫ Vsz Firmware Version < 3.6.2.0.795
   Ruckuswireless ≫ Vsz Version -
Ruckuswireless ≫ Zonedirector 1100 Firmware Version 9.10.2.0.130
   Ruckuswireless ≫ Zonedirector 1100 Version -
Ruckuswireless ≫ Zonedirector 1200 Firmware Version 10.2.1.0.218
   Ruckuswireless ≫ Zonedirector 1200 Version -
Ruckuswireless ≫ Zonedirector 3000 Firmware Version 10.2.1.0.218
   Ruckuswireless ≫ Zonedirector 3000 Version -
Ruckuswireless ≫ Zonedirector 5000 Firmware Version 10.0.1.0.151
   Ruckuswireless ≫ Zonedirector 5000 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.26% 0.656
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA-ADP 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

https://hdhrmi.blogspot.com/2020/03/multiple-vulnerabilities-in-ruckus.html?m=1
https://support.ruckuswireless.com/security_bulletins/302
Patch
Vendor Advisory