cbcvebase.
CVE-2017-6224
published 2017-10-13

CVE-2017-6224: Ruckus Wireless Zone Director Controller firmware releases ZD9.x, ZD10.0.0.x, ZD10.0.1.x (less than 10.0.1.0.17 MR1 release) and Ruckus Wireless Unleashed AP…

PriorityP347high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
1.21%
64.6th percentile
Ruckus Wireless Zone Director Controller firmware releases ZD9.x, ZD10.0.0.x, ZD10.0.1.x (less than 10.0.1.0.17 MR1 release) and Ruckus Wireless Unleashed AP Firmware releases 200.0.x, 200.1.x, 200.2.x, 200.3.x, 200.4.x. contain OS Command Injection vulnerabilities that could allow local authenticated users to execute arbitrary privileged commands on the underlying operating system by appending those commands in the Common Name field in the Certificate Generation Request.

Affected

19 ranges
VendorProductVersion rangeFixed in
brocade_communications_systems_inczone_director_controller_and_unleashed_ap_firmware——
brocade_communications_systems_inczone_director_controller_and_unleashed_ap_firmware——
brocade_communications_systems_inczone_director_controller_and_unleashed_ap_firmware——
brocade_communications_systems_inczone_director_controller_and_unleashed_ap_firmware——
brocade_communications_systems_inczone_director_controller_and_unleashed_ap_firmware——
brocade_communications_systems_inczone_director_controller_and_unleashed_ap_firmware——
brocade_communications_systems_inczone_director_controller_and_unleashed_ap_firmware——
ruckuswirelessunleashed_firmware——
ruckuswirelessunleashed_firmware——
ruckuswirelessunleashed_firmware——
ruckuswirelessunleashed_firmware——
ruckuswirelessunleashed_firmware——
ruckuswirelessunleashed_firmware——
ruckuswirelesszonedirector_firmware——
ruckuswirelesszonedirector_firmware——
ruckuswirelesszonedirector_firmware——
ruckuswirelesszonedirector_firmware——
ruckuswirelesszonedirector_firmware——
ruckuswirelesszonedirector_firmware——

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.