Details of VAR-201802-0642

ID

VAR-201802-0642

CVE

CVE-2017-6229

TITLE

Ruckus Networks Unleashed AP and Zone Director In firmware OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-012629

DESCRIPTION

Ruckus Networks Unleashed AP firmware releases before 200.6.10.1.x and Ruckus Networks Zone Director firmware releases 10.1.0.0.x, 9.10.2.0.x, 9.12.3.0.x, 9.13.3.0.x, 10.0.1.0.x or before contain authenticated Root Command Injection in the CLI that could allow authenticated valid users to execute privileged commands on the respective systems. Both Ruckus Networks Unleashed AP and Ruckus Networks Zone Director are wireless access points from Ruckus Wireless. A remote attacker could exploit this vulnerability to execute privileged commands

Trust: 1.71

sources: NVD: CVE-2017-6229 // JVNDB: JVNDB-2017-012629 // VULHUB: VHN-114432

AFFECTED PRODUCTS

vendor:	ruckuswireless	model:	zonedirector 1200	scope:	eq	version:	10.1.0.0.1515	Trust: 1.6
vendor:	ruckuswireless	model:	zonedirector 3000	scope:	eq	version:	10.1.0.0.1515	Trust: 1.6
vendor:	ruckuswireless	model:	zonedirector 3000	scope:	gte	version:	9.12.3.0.28	Trust: 1.0
vendor:	ruckuswireless	model:	t300e	scope:	lt	version:	200.6.10.1.0	Trust: 1.0
vendor:	ruckuswireless	model:	zonedirector 1200	scope:	gte	version:	9.13.3.0.22	Trust: 1.0
vendor:	ruckuswireless	model:	t301	scope:	lt	version:	200.6.10.1.0	Trust: 1.0
vendor:	ruckuswireless	model:	r710	scope:	lt	version:	200.6.10.1.0	Trust: 1.0
vendor:	ruckuswireless	model:	r500	scope:	lt	version:	200.6.10.1.0	Trust: 1.0
vendor:	ruckuswireless	model:	t710	scope:	lt	version:	200.6.10.1.0	Trust: 1.0
vendor:	ruckuswireless	model:	r310	scope:	lt	version:	200.6.10.1.0	Trust: 1.0
vendor:	ruckuswireless	model:	h510	scope:	lt	version:	200.6.10.1.0	Trust: 1.0
vendor:	ruckuswireless	model:	r600	scope:	lt	version:	200.6.10.1.0	Trust: 1.0
vendor:	ruckuswireless	model:	zonedirector 1200	scope:	lte	version:	9.13.3.0.145	Trust: 1.0
vendor:	ruckuswireless	model:	zonedirector 3000	scope:	lte	version:	9.10.2.0.53	Trust: 1.0
vendor:	ruckuswireless	model:	zonedirector 1200	scope:	lte	version:	9.12.3.0.83	Trust: 1.0
vendor:	ruckuswireless	model:	zonedirector 3000	scope:	lte	version:	10.0.1.0.44	Trust: 1.0
vendor:	ruckuswireless	model:	t300	scope:	lt	version:	200.6.10.1.0	Trust: 1.0
vendor:	ruckuswireless	model:	zonedirector 1200	scope:	gte	version:	10.0.1.0.17	Trust: 1.0
vendor:	ruckuswireless	model:	zonedirector 1200	scope:	gte	version:	9.10.2.0.11	Trust: 1.0
vendor:	ruckuswireless	model:	t610	scope:	lt	version:	200.6.10.1.0	Trust: 1.0
vendor:	ruckuswireless	model:	zonedirector 3000	scope:	gte	version:	9.13.3.0.22	Trust: 1.0
vendor:	ruckuswireless	model:	r720	scope:	lt	version:	200.6.10.1.0	Trust: 1.0
vendor:	ruckuswireless	model:	r510	scope:	lt	version:	200.6.10.1.0	Trust: 1.0
vendor:	ruckuswireless	model:	zonedirector 3000	scope:	gte	version:	10.0.1.0.17	Trust: 1.0
vendor:	ruckuswireless	model:	zonedirector 3000	scope:	gte	version:	9.10.2.0.11	Trust: 1.0
vendor:	ruckuswireless	model:	zonedirector 1200	scope:	gte	version:	9.12.3.0.28	Trust: 1.0
vendor:	ruckuswireless	model:	h320	scope:	lt	version:	200.6.10.1.0	Trust: 1.0
vendor:	ruckuswireless	model:	zonedirector 1200	scope:	lte	version:	10.0.1.0.44	Trust: 1.0
vendor:	ruckuswireless	model:	zonedirector 1200	scope:	lte	version:	9.10.2.0.53	Trust: 1.0
vendor:	ruckuswireless	model:	zonedirector 3000	scope:	lte	version:	9.13.3.0.145	Trust: 1.0
vendor:	ruckuswireless	model:	zonedirector 3000	scope:	lte	version:	9.12.3.0.83	Trust: 1.0
vendor:	ruckus	model:	h320	scope:	-	version:	-	Trust: 0.8
vendor:	ruckus	model:	h510	scope:	-	version:	-	Trust: 0.8
vendor:	ruckus	model:	r310	scope:	-	version:	-	Trust: 0.8
vendor:	ruckus	model:	r500	scope:	-	version:	-	Trust: 0.8
vendor:	ruckus	model:	r510	scope:	-	version:	-	Trust: 0.8
vendor:	ruckus	model:	r600	scope:	-	version:	-	Trust: 0.8
vendor:	ruckus	model:	r710	scope:	-	version:	-	Trust: 0.8
vendor:	ruckus	model:	r720	scope:	-	version:	-	Trust: 0.8
vendor:	ruckus	model:	t300	scope:	-	version:	-	Trust: 0.8
vendor:	ruckus	model:	t300e	scope:	-	version:	-	Trust: 0.8
vendor:	ruckus	model:	t301	scope:	-	version:	-	Trust: 0.8
vendor:	ruckus	model:	t610	scope:	-	version:	-	Trust: 0.8
vendor:	ruckus	model:	t710	scope:	-	version:	-	Trust: 0.8
vendor:	ruckus	model:	zonedirector 1200	scope:	-	version:	-	Trust: 0.8
vendor:	ruckus	model:	zonedirector 3000	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2017-012629 // CNNVD: CNNVD-201802-916 // NVD: CVE-2017-6229

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-6229
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-6229
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201802-916
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-114432
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2017-6229
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-114432
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-6229
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-114432 // JVNDB: JVNDB-2017-012629 // CNNVD: CNNVD-201802-916 // NVD: CVE-2017-6229

PROBLEMTYPE DATA

problemtype:

CWE-78

Trust: 1.9

sources: VULHUB: VHN-114432 // JVNDB: JVNDB-2017-012629 // NVD: CVE-2017-6229

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201802-916

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201802-916

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-012629

PATCH

title:

Authenticated Root Command Injection Vulnerabilities in CLI of ZD/Unleashed APs and Web-GUI of Solo/SZ Managed APs (CVE-2017-6229, CVE2017-6230)

url:

https://ruckus-www.s3.amazonaws.com/pdf/security/faq-security-advisory-id-20180202-v1.0.txt

Trust: 0.8

sources: JVNDB: JVNDB-2017-012629

EXTERNAL IDS

db:	NVD	id:	CVE-2017-6229	Trust: 2.5
db:	JVNDB	id:	JVNDB-2017-012629	Trust: 0.8
db:	CNNVD	id:	CNNVD-201802-916	Trust: 0.7
db:	VULHUB	id:	VHN-114432	Trust: 0.1

sources: VULHUB: VHN-114432 // JVNDB: JVNDB-2017-012629 // CNNVD: CNNVD-201802-916 // NVD: CVE-2017-6229

REFERENCES

url:	https://ruckus-www.s3.amazonaws.com/pdf/security/faq-security-advisory-id-20180202-v1.0.txt	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6229	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-6229	Trust: 0.8

sources: VULHUB: VHN-114432 // JVNDB: JVNDB-2017-012629 // CNNVD: CNNVD-201802-916 // NVD: CVE-2017-6229

SOURCES

db:	VULHUB	id:	VHN-114432
db:	JVNDB	id:	JVNDB-2017-012629
db:	CNNVD	id:	CNNVD-201802-916
db:	NVD	id:	CVE-2017-6229

LAST UPDATE DATE

2024-11-23T23:08:46.893000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-114432	date:	2018-03-12T00:00:00
db:	JVNDB	id:	JVNDB-2017-012629	date:	2018-03-28T00:00:00
db:	CNNVD	id:	CNNVD-201802-916	date:	2018-08-21T00:00:00
db:	NVD	id:	CVE-2017-6229	date:	2024-11-21T03:29:18.477

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-114432	date:	2018-02-14T00:00:00
db:	JVNDB	id:	JVNDB-2017-012629	date:	2018-03-28T00:00:00
db:	CNNVD	id:	CNNVD-201802-916	date:	2018-02-14T00:00:00
db:	NVD	id:	CVE-2017-6229	date:	2018-02-14T19:29:00.213