CVE-2019-19836

Published: Jan 22, 2020Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote code execution via a POST request that uses tools/_rcmdstat.jsp to write to a specified filename.

Affected (7)

Products: Ruckuswireless: Unleashed, Zonedirector 1200 Firmware

Ruckuswireless

2 products

Unleashed

Zonedirector 1200 Firmware

Configuration A

1 vulnerable · 14 platform

Vulnerable Software	Affected Versions
Ruckuswireless Unleashed	Before 200.7.10.202.94

Running on/with	Platform Versions
Ruckuswireless C110	All versions
Ruckuswireless E510	All versions
Ruckuswireless H320	All versions
Ruckuswireless H510	All versions
Ruckuswireless M510	All versions
Ruckuswireless R310	All versions
Ruckuswireless R320	All versions
Ruckuswireless R510	All versions
Ruckuswireless R610	All versions
Ruckuswireless R710	All versions
Ruckuswireless R720	All versions
Ruckuswireless T310	All versions
Ruckuswireless T610	All versions
Ruckuswireless T710	All versions

Configuration B

6 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ruckuswireless Zonedirector 1200 Firmware	Before 9.10.2.0.84
Ruckuswireless Zonedirector 1200 Firmware	From 10.1.0 to 10.1.2.0.275
Ruckuswireless Zonedirector 1200 Firmware	From 10.2.0 to 10.2.1.0.147
Ruckuswireless Zonedirector 1200 Firmware	From 10.3.0 to 10.3.1.0.21
Ruckuswireless Zonedirector 1200 Firmware	From 9.12.0 to 9.12.3.0.136
Ruckuswireless Zonedirector 1200 Firmware	From 9.13.0 to 10.0.1.0.90