RCE in Brocade Communications Systems, Inc. Zone Director Controller Firmware
CVE-2017-6223
Ruckus Wireless Zone Director Controller firmware releases ZD9.9.x, ZD9.10.x, ZD9.13.0.x less than 9.13.0.0.232 contain OS Command Injection vulnerabilities in the ping functionality that could allow local authenticated users to execute arbitrary privileged commands on the underlying operating system.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.017 (75.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Brocade Communications Systems, Inc. Zone Director Controller Firmware — versions ZD9.9.x, ZD9.10.x, ZD9.13.0.x
- Ruckus Zonedirector
- Ruckus Zonedirector_firmware — versions zd9.9.0.0.205, zd9.9.0.0.212, zd9.9.0.0.216
Weakness classification (CWE)
References
- sirt@brocade.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-6223?
- CVE-2017-6223 is a high-severity vulnerability in Brocade Communications Systems, Inc. Zone Director Controller Firmware, classified under OS Command Injection. CVSS score: 8.8/10. Published 2017-10-13.
- How severe is CVE-2017-6223?
- High severity. CVSS v3 base score is 8.8 out of 10.