Security Notice 20191224 ZoneDirector and Unleashed Unauthenticated Remote Code Execution and Other Vulnerabilities

[grodog-prod]

The RuckusNetworks Support Portal Security page has been updated with Security Notice 20191224 ZoneDirector and Unleashed Unauthenticated Remote Code Execution and Other Vulnerabilities. Security Notice 20191224 is located at https://support.ruckuswireless.com/security_bulletins/299 and can be downloaded in PDF and TXT formats.  


What is the issue?

A number of security vulnerabilities are found on the ZoneDirector and Unleashed product lines. Collectively, these vulnerabilities allow an attacker to perform the following actions:

• Unauthenticated, remote code executions and unauthorized command line interface (CLI) and shell access
• Command injections
• Unauthenticated stack overflow
• Unauthenticated arbitrary file writing
• Server-Side Request Forgery (SSRF)

What action should I take?

Ruckus Networks is releasing the fix for these vulnerabilities through a software update. Because these are CRITICAL issues, all customers are strongly encouraged to apply the fix once available.

Further details including are available in the full text of Security Notice 20191224 at https://support.ruckuswireless.com/security_bulletins/299.  

[pradeep_kumar_h]

9.13.x has to Upgrade to 10.0.1 MR1 Refresh 6

RN: https://support.ruckuswireless.com/documents/3109-zonedirector-10-0-1-mr1-refresh6-release-notes

Image: https://support.ruckuswireless.com/software/2285-zd1200-10-0-1-0-90-mr1-refresh6-software-release

[john_d]

Is the attack surface isolated to having access to the management VLAN to talk to the APs / ZD instance, or for Unleashed since it can be managed over the cloud, is there a wider attack surface?

Trying to decide if the update justifies bringing my networks down over Christmas!

[pradeep_kumar_h]

Hi John,

I am not able to understand "Unleashed since it can be managed over the cloud", please reach out to Ruckus Support to discuss the impact and resolution.

Regards,
Pradeep

[john_d]

Thanks Pradeep -- the recently published FAQ for Unleashed home users answered my question. Attacking a vulnerable AP requires local network access, which is at least a little bit of a silver lining. I was worried earlier that the attacker could've been anywhere on the internet if they are somehow able to use the same communication mechanism as the Unleashed mobile app to talk to a vulnerable AP over the WAN, but that does not appear to be the case.

Thank you for the quick and coordinated response to this vulnerability!