CVE-2021-33215

An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The API allows Directory Traversal...

PT-2021-20087

Name of the Vulnerable Software and Affected Versions CommScope Ruckus IoT Controller versions 1.7.1.0 and earlier Description An issue in the Web Application of the CommScope Ruckus IoT Controller allows authenticated users to perform arbitrary read/write actions. The API endpoint allows an HTTP...

PT-2021-20091

Name of the Vulnerable Software and Affected Versions CommScope Ruckus IoT Controller versions 1.7.1.0 and earlier Description An issue was discovered where hard-coded API keys exist. Recommendations For CommScope Ruckus IoT Controller versions 1.7.1.0 and earlier, update to a version that...

PT-2021-20088

Name of the Vulnerable Software and Affected Versions CommScope Ruckus IoT Controller versions 1.7.1.0 and earlier Description An issue was discovered that involves hard-coded system passwords, which provide shell access. Recommendations For CommScope Ruckus IoT Controller versions 1.7.1.0 and...

PT-2021-20089

Name of the Vulnerable Software and Affected Versions CommScope Ruckus IoT Controller versions 1.7.1.0 and earlier Description An issue was discovered where hard-coded web application administrator passwords exist for the admin and nplus1user accounts. Recommendations For CommScope Ruckus IoT...

PT-2021-20092

Name of the Vulnerable Software and Affected Versions CommScope Ruckus IoT Controller versions 1.7.1.0 and earlier Description An issue was discovered that involves Unauthenticated API Endpoints. Recommendations For CommScope Ruckus IoT Controller versions 1.7.1.0 and earlier, consider restrictin...

CVE-2021-33221: Missing Authentication for Critical Function

An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Unauthenticated API Endpoints...

CVE-2021-33220: Use of Hard-coded Credentials

An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. Hard-coded API Keys exist...

CVE-2021-33219: Use of Hard-coded Credentials

An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded Web Application Administrator Passwords for the admin and nplus1user accounts...

CVE-2021-33217: Out-of-bounds Write

An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The Web Application allows Arbitrary Read/Write actions by authenticated users. The API allows an HTTP POST of arbitrary content into any file on the filesystem as root...

CVE-2021-33216: Undefined Security Weakness

An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. An Undocumented Backdoor exists, allowing shell access via a developer account...

CVE-2021-33218: Use of Hard-coded Credentials

An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded System Passwords that provide shell access...

CVE-2021-33215: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The API allows Directory Traversal...

PT-2021-20085

Name of the Vulnerable Software and Affected Versions CommScope Ruckus IoT Controller versions 1.7.1.0 and earlier Description An issue was discovered that allows Directory Traversal through the API. Recommendations For CommScope Ruckus IoT Controller versions 1.7.1.0 and earlier, update to a...

CommScope Ruckus IoT Controller 信任管理问题漏洞

The Commscope CommScope Ruckus IoT Controller is an IoT controller from Commscope, Inc. A virtual controller that integrates with the SmartZone controller to perform connectivity, device and security management functions for non-Wi-Fi devices. A trust management issue vulnerability exists in...

CommScope Ruckus IoT Controller 1.7.1.0 Hard-Coded System Passwords

KL-001-2021-003: CommScope Ruckus IoT Controller Hard-coded System Passwords Title: CommScope Ruckus IoT Controller Hard-coded System Passwords Advisory ID: KL-001-2021-003 Publication Date: 2021.05.26 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2021-003.txt 1. Vulnerabilit...

CommScope Ruckus IoT Controller 1.7.1.0 Hard-Coded Web Application Administrator Password

KL-001-2021-004: CommScope Ruckus IoT Controller Hard-coded Web Application Administrator Password Title: CommScope Ruckus IoT Controller Hard-coded Web Application Administrator Password Advisory ID: KL-001-2021-004 Publication Date: 2021.05.26 Publication URL:...

CommScope Ruckus IoT Controller 1.7.1.0 Web Application Arbitrary Read/Write Vulnerability

The IoT Controller web application includes a NodeJS module, node-red, which has the capability for users to read or write to local files on the IoT Controller. With the elevated privileges the web application runs as, this allowed for reading and writing to any file on the IoT Controller...

CommScope Ruckus IoT Controller 1.7.1.0 Hard-Coded API Keys Exposed

KL-001-2021-002: CommScope Ruckus IoT Controller Hard-coded API Keys Exposed Title: CommScope Ruckus IoT Controller Hard-coded API Keys Exposed Advisory ID: KL-001-2021-002 Publication Date: 2021.05.26 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2021-002.txt 1. Vulnerabilit...

CommScope Ruckus IoT Controller 1.7.1.0 Web Application Arbitrary Read/Write

KL-001-2021-006: CommScope Ruckus IoT Controller Web Application Arbitrary Read/Write Title: CommScope Ruckus IoT Controller Web Application Arbitrary Read/Write Advisory ID: KL-001-2021-006 Publication Date: 2021.05.26 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2021-006.t...