Vulnerability in N/a
CVE-2020-26878
Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API (/service/v1/createUser endpoint), injecting arbitrary commands that will be executed as root user via web.py.
EPSS: 0.630 (98.4th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
Public proof-of-concept exploits
References
- adepts.of0x.cc (x_refsource_MISC)
- twitter.com/TheXC3LL (x_refsource_MISC)
- x-c3ll.github.io (x_refsource_MISC)
- support.ruckuswireless.com/documents (x_refsource_MISC)
- support.ruckuswireless.com/security_bulletins/305 (x_refsource_CONFIRM)
- adepts.of0x.cc/ruckus-vriot-rce/ (x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-26878?
- CVE-2020-26878 is a vulnerability in N/a. Published 2020-10-26.
- Is CVE-2020-26878 known to be exploited?
- 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.