CVE-2019-19840

A stack-based buffer overflow in zap_parse_args in zap.c in zap in Ruckus Unleashed through 200.7.10.102.64 allows remote code execution via an unauthenticated HTTP request.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 95%
VendorProductVersion
ruckuswirelessunleashed
𝑥
< 200.7.10.202.94
ruckuswirelesszonedirector_1200_firmware
𝑥
< 9.10.2.0.84
ruckuswirelesszonedirector_1200_firmware
9.12.0 ≤
𝑥
< 9.12.3.0.136
ruckuswirelesszonedirector_1200_firmware
9.13.0 ≤
𝑥
< 10.0.1.0.90
ruckuswirelesszonedirector_1200_firmware
10.1.0 ≤
𝑥
< 10.1.2.0.275
ruckuswirelesszonedirector_1200_firmware
10.2.0 ≤
𝑥
< 10.2.1.0.147
ruckuswirelesszonedirector_1200_firmware
10.3.0 ≤
𝑥
< 10.3.1.0.21
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://alephsecurity.com/2020/01/14/ruckus-wireless
https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html
https://www.ruckuswireless.com/security/299/view/txt
https://alephsecurity.com/2020/01/14/ruckus-wireless
https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html
https://www.ruckuswireless.com/security/299/view/txt