Ruckus Virtual SmartZone OS Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in Ruckus SmartZone (SZ) versions prior to 6.1.2p3 Refresh Build. This vulnerability allows authenticated users to inject operating system commands via an IP address field, which is not properly sanitized before execution. As a result, an attacker could execute arbitrary commands on the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.

Remediation

Ruckus has released patches for this vulnerability. Users are advised to upgrade to version 6.1.2p3 Refresh Build or to one of the KSP versions available for 5.2.2, 5.2.1.3, or 7.1. For Ruckus Network Director, users should upgrade to version 3.0, 4.0, or 4.5.