CVE-2017-6224

Description

Ruckus Wireless Zone Director Controller firmware releases ZD9.x, ZD10.0.0.x, ZD10.0.1.x (less than 10.0.1.0.17 MR1 release) and Ruckus Wireless Unleashed AP Firmware releases 200.0.x, 200.1.x, 200.2.x, 200.3.x, 200.4.x. contain OS Command Injection vulnerabilities that could allow local authenticated users to execute arbitrary privileged commands on the underlying operating system by appending those commands in the Common Name field in the Certificate Generation Request.

References

Link	Tags
https://ruckus-www.s3.amazonaws.com/pdf/security/faq-security-advisory-id-092917.txt	third party advisory

Frequently Asked Questions

What is the severity of CVE-2017-6224?: CVE-2017-6224 has been scored as a high severity vulnerability.
How to fix CVE-2017-6224?: To fix CVE-2017-6224, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2017-6224 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2017-6224 is being actively exploited. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2017-6224?: CVE-2017-6224 affects Brocade Communications Systems, Inc. Zone Director Controller and Unleashed AP Firmware.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.

Description

Category

CWE-78 – Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

References

Frequently Asked Questions