Remote Command Execution in Ruckus ZoneFlex R500 Devices
CVE-2020-8438

7.2HIGH

Key Information:

Vendor

Arris

Status
Ruckus Zoneflex R500 Firmware
Vendor
CVE Published:
29 January 2020

What is CVE-2020-8438?

The vulnerability in Ruckus ZoneFlex R500 devices allows authenticated attackers to execute arbitrary operating system commands by exploiting a hidden form named /forms/nslookupHandler. This can facilitate unauthorized system access and potential data compromise, underscoring the importance of securing affected devices against such exploits.

References

https://sku11army.blogspot.com/2020/01/ruckus-rce-ruckus-...
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.