nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

R650 unleashed cve-2023-48795

MWSS

Hello,

On a recent pen test, all the APs on our network (10 in total) are flagged with CVE-2023-48795. We've updated to the latest firmware of 200.17.7.0.152 but it's still the same.

Please can you advise? is it possible to turn off ssh if there is no fix but it's quite an old cve.

thanks

Find more posts tagged with

Accepted answers

All comments

JacksonCampbell

I would email support or fill out the support form and bug them until they reply to your specific security issue. Please reply back here with what they do about it when you get a satisfactory reply.

MWSS

annoyingly we dont have a support contract any longer so Im unable to speak to them directly.

BobaEnjoyer

I looked up the CVE:

https://nvd.nist.gov/vuln/detail/CVE-2023-48795
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795

Is the solution for Ruckus to simply upgrade whatever SSH server they are using to the newest version (that addresses the vulnerability)?

Re: your second question, I looked up the CLI Reference Guide, and I don't see a way to disable SSH, because I assume by doing so there would be no way to re-enable it.

Hope Ruckus team gets this, as it seems like the hotfix is just to upgrade the SSH server in Unleashed to the latest version.

JacksonCampbell

You can contact them directly like anyone else. There is a support form in the Unleashed web GUI and app.

JacksonCampbell

I assume if it was disabled then you could re-enable it by resetting the AP or Unleashed network.

sanjay_kumar

Hi,

This issue is already worked on and will be fixed in 200.18

MWSS

thanks, when will that be released?

sanjay_kumar

Current EAT is end of April. I will keep you posted if there are any changes.

MWSS

Hello Sanjay.

we have our pen test the last week of April. Im hoping the fix will be released before then so I dont have to plan remediation documentation. Just checking in if a date is in mind?