nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

SmartZone-100 product has security vulnerabilities.Hackers can use udp9001 port to launch ddos reflection amplification attack

unknown

I am a security researcher from Baidu，Recently, we have detected a large number of hacking incidents from ddos attacks initiated on the UDP9001 port on the SmartZone-100 device. Great harm!!!

Refer to my screenshot for details.my phone number is 18903860673

My email address is 18903860673@163.com， I come from Baidu in China，Hope you guys get back to me as soon as possible，

Image_ images_messages_60e2e826343e2b0bb01b8590_219bd35fad14c5417a7d39494614700d_1-26b24858-5030-47b4-b43a-b44b450c4a75-46734060.png

Image_ images_messages_60e2e826343e2b0bb01b8590_f0303439659a2da30844ab8530b7fbb5_4-bf56df6d-8c4f-4824-a102-978858c41c8a-49504623.png

Image_ images_messages_60e2e826343e2b0bb01b8590_08d613990b078e9c2e92d2c3c5c6df48_5-37ecab71-5b48-4656-8707-bac7a4541638-50428144.png

Find more posts tagged with

Accepted answers

All comments

unknown

Hello li_xiang,

We use port 9001 for Elastic Search DB update and also sync with member node in the vSZ/SZ Cluster. Please feel free to report a case with us for further investigation. Also make sure to mention the current firmware running on the SZ.

Regards,

Parikshith

unknown

@parikshith_nagaraj_aa0004 Can you tell me the business situation? What is the relationship between SmartZone-100 and ES, and why will ES services be deployed on SmartZone-100? At present, these SmartZone-100 devices still have problems. Port 9001 can accept any UDP request to respond to very large data packets, which will be used by hackers.

unknown

Hi @li_xiang,

As per the design, ES helps fetch data from Cassandra DB and present it to Web GUI. Also maintains the DB between different SZ Nodes in the cluster.

As suggested please feel free to report a case for further investigation.

Regards,

Parikshith

unknown

@parikshith_nagaraj_aa0004 Is the ES deployed on SZ an ES service or a plug-in

unknown

@li_xiang, Yes, we have ES Service deployed on SZ. If you run "Show service" from CLI, should be able to see the status.

Regards,

Parikshith

syamantakomer

Hi Li,

Our security team has been notified to review this.

unknown

@parikshith_nagaraj_aa0004 udp9001 is filebeat plugin？？？

unknown

@parikshith_nagaraj_aa0004 could you tell me the Software version of filebeat？

unknown

@syamantak_omer could you tell me 9001 is filebeat service???

allan_grohe

@li_xiang and @parikshith_nagaraj_aa0004 and @syamantak_omer : you're still able to read and access this thread after we shifted it private, correct?

Allan.

unknown

@allan_grohe Yes, we can access ip and port through UDP protocol and receive excessive response packets. Can you tell me what service is opened on port 9001? It should not be es, but filebeat? What is the specific service?

allan_grohe

@syamantak_omer and @parikshith_nagaraj_aa0004 can help you better then me on that front, @li_xiang---I'm not technical in our products like they are!

Allan.

syamantakomer

Hi All,

This vulnerabilities has been fixed by our engineering team.

Refer the security advisory from the below link.

https://support.ruckuswireless.com/security_bulletins/312