RCE in Brocade Communications Systems, Inc. Zone Director Controller And Unleashed Ap Firmware
CVE-2017-6224
Ruckus Wireless Zone Director Controller firmware releases ZD9.x, ZD10.0.0.x, ZD10.0.1.x (less than 10.0.1.0.17 MR1 release) and Ruckus Wireless Unleashed AP Firmware releases 200.0.x, 200.1.x, 200.2.x, 200.3.x, 200.4.x. contain OS Command Injection vulnerabilities that could allow local authenticated users to execute arbitrary privileged commands on the underlying operating system by appending those commands in the Common Name field in the Certificate Generation Request.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.012 (67.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 67th percentile — 67.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: 0.000
Affected products
- Brocade Communications Systems, Inc. Zone Director Controller And Unleashed Ap Firmware — versions 200.3.x, ZD10.0.1.x, ZD9.x
- Ruckuswireless Unleashed
- Ruckuswireless Unleashed Firmware — versions 200.1, 200.1.9.12.55, 200.3
- Ruckuswireless Zonedirector
- Ruckuswireless Zonedirector Firmware — versions zd9.9.0.0.205, zd9.9.0.0.212, zd9.9.0.0.216
Weakness classification (CWE)
References
- ruckus-www.s3.amazonaws.com/pdf/security/faq-security-advisory-id-092917.txt (Third Party Advisory)
Frequently asked questions
- What is CVE-2017-6224?
- CVE-2017-6224 is a high-severity vulnerability in Brocade Communications Systems, Inc. Zone Director Controller And Unleashed Ap Firmware, classified under OS Command Injection. CVSS score: 8.8/10. Published 2017-10-13.
- How severe is CVE-2017-6224?
- High severity. CVSS v3 base score is 8.8 out of 10.