RCE in Brocade Communications Systems, Inc. Zone Director Controller And Unleashed Ap Firmware
CVE-2017-6224
Ruckus Wireless Zone Director Controller firmware releases ZD9.x, ZD10.0.0.x, ZD10.0.1.x (less than 10.0.1.0.17 MR1 release) and Ruckus Wireless Unleashed AP Firmware releases 200.0.x, 200.1.x, 200.2.x, 200.3.x, 200.4.x. contain OS Command Injection vulnerabilities that could allow local authenticated users to execute arbitrary privileged commands on the underlying operating system by appending those commands in the Common Name field in the Certificate Generation Request.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.012 (65.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Brocade Communications Systems, Inc. Zone Director Controller And Unleashed Ap Firmware — versions 200.3.x, ZD10.0.1.x, ZD9.x
- Ruckuswireless Unleashed
- Ruckuswireless Unleashed_firmware — versions 200.1, 200.1.9.12.55, 200.3
- Ruckuswireless Zonedirector
- Ruckuswireless Zonedirector_firmware — versions zd9.9.0.0.205, zd9.9.0.0.212, zd9.9.0.0.216
Weakness classification (CWE)
References
- sirt@brocade.com (x_refsource_CONFIRM, Third Party Advisory)
Frequently asked questions
- What is CVE-2017-6224?
- CVE-2017-6224 is a high-severity vulnerability in Brocade Communications Systems, Inc. Zone Director Controller And Unleashed Ap Firmware, classified under OS Command Injection. CVSS score: 8.8/10. Published 2017-10-13.
- How severe is CVE-2017-6224?
- High severity. CVSS v3 base score is 8.8 out of 10.