Ruckus Zoneflex R500 Firmware Security Vulnerabilities - 2020

CVE-2020-7983

A CSRF issue in login.asp on Ruckus R500 3.4.2.0.384 devices allows remote attackers to access the panel or conduct SSRF attacks.

CVE-2020-8033

Ruckus R500 3.4.2.0.384 devices allow XSS via the index.asp Device Name field.

CVE-2020-8830

CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA-1 field on the Wireless Admin screen.