Vulnerability in N/a
CVE-2020-26879
Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorization header.
EPSS: 0.889 (99.5th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
Public proof-of-concept exploits
References
- adepts.of0x.cc (x_refsource_MISC)
- twitter.com/TheXC3LL (x_refsource_MISC)
- x-c3ll.github.io (x_refsource_MISC)
- support.ruckuswireless.com/documents (x_refsource_MISC)
- support.ruckuswireless.com/security_bulletins/305 (x_refsource_CONFIRM)
- adepts.of0x.cc/ruckus-vriot-rce/ (x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-26879?
- CVE-2020-26879 is a vulnerability in N/a. Published 2020-10-26.
- Is CVE-2020-26879 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.