CRITICAL🇵🇱 Wersja polska

CVE-2019-19843

CVSS 9.8v3.1pub. 2020-01-22upd. 2024-11-21

Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a symlink with /tmp and web/user/wps_tool_cache.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Ruckuswireless C110

    HW
    Ruckuswireless
    all versions

  • Ruckuswireless E510

    HW
    Ruckuswireless
    all versions

  • Ruckuswireless H320

    HW
    Ruckuswireless
    all versions

  • Ruckuswireless H510

    HW
    Ruckuswireless
    all versions

  • Ruckuswireless M510

    HW
    Ruckuswireless
    all versions

  • Ruckuswireless R310

    HW
    Ruckuswireless
    all versions

  • Ruckuswireless R320

    HW
    Ruckuswireless
    all versions

  • Ruckuswireless R510

    HW
    Ruckuswireless
    all versions

  • Ruckuswireless R610

    HW
    Ruckuswireless
    all versions

  • Ruckuswireless R710

    HW
    Ruckuswireless
    all versions

  • Ruckuswireless R720

    HW
    Ruckuswireless
    all versions

  • Ruckuswireless T310

    HW
    Ruckuswireless
    all versions

  • Ruckuswireless T610

    HW
    Ruckuswireless
    all versions

  • Ruckuswireless T710

    HW
    Ruckuswireless
    all versions

  • Ruckuswireless Unleashed

    OS
    Ruckuswireless
    < 200.7.10.202.94

  • Ruckuswireless Zonedirector 1200

    HW
    Ruckuswireless
    all versions

  • Ruckuswireless Zonedirector 1200 Firmware

    OS
    Ruckuswireless
    9.12.0 – 9.12.3.0.136 (excl.)9.13.0 – 10.0.1.0.90 (excl.)< 9.10.2.0.8410.2.0 – 10.2.1.0.147 (excl.)10.3.0 – 10.3.1.0.21 (excl.)10.1.0 – 10.1.2.0.275 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-25717CRITICAL9.8⚠ KEVPL ✓same product

RCE bez uwierzytelnienia w Ruckus Wireless Admin (do wersji 10.4)

CVE-2020-22653CRITICAL9.8PL ✓same product

Ruckus Wireless — nieautoryzowane wstrzyknięcie sygnatury obrazu firmware

CVE-2020-22654CRITICAL9.8PL ✓same product

Ruckus Wireless — obejście weryfikacji sumy kontrolnej MD5 firmware

CVE-2020-22657CRITICAL9.1PL ✓same product

Pominięcie uwierzytelnienia w interfejsie WEB GUI urządzeń Ruckus Wireless

CVE-2020-22658CRITICAL9.8PL ✓same product

Ruckus Wireless — podmiana obrazu firmware na nieautoryzowany przy starcie