Ruckus SmartZone OS Command Injection Vulnerability Allowing Remote Code Execution

A remote code execution vulnerability has been identified in Ruckus SmartZone (SZ) versions prior to 6.1.2p3 Refresh Build. The issue arises from improper sanitization of a user-controlled parameter in an API route, allowing for OS command injection. An attacker could exploit this vulnerability by injecting a malicious payload that is executed as a command on the operating system, leading to unauthorized code execution.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.

Remediation

Users are advised to upgrade to Ruckus SmartZone versions 6.1.2p3 Refresh Build, 7.1, 5.2.2, or 5.2.1.3. For those with the Ruckus Network Director, upgrading to versions 3.0, 4.0, or 4.5 is recommended. After applying the KSP for SmartZone, contact the Ruckus support team to avoid possible KSP conflicts.