CVE-2019-19841

CVE-2019-19841 affects Ruckus Wireless Unleashed firmware prior to or up to 200.7.10.102.64, where emfd allows remote command execution via a POST request to admin/_cmdstat.jsp with xcmd=packet-capture and the mac attribute. The connected documents confirm the issue and its description across mul...

CVE-2019-19834

CVE-2019-19834 concerns a directory traversal in the ruckus_cli2 component of Ruckus Wireless Unleashed firmware (affected version range up to 200.7.10.102.64). The vulnerability allows a remote attacker to jailbreak the CLI by supplying a crafted argument through enable->debug->script->...

CVE-2019-19842

CVE-2019-19842 affects Ruckus Wireless Unleashed firmware (example: 200.7.10.102.64). It allows remote command execution by sending a POST to admin/_cmdstat.jsp with the attribute xcmd=spectra-analysis and the mac attribute. This is a network-accessible issue with an attacker having no authentica...

CVE-2019-19836

CVE-2019-19836 affects Ruckus Wireless Unleashed firmware (up to 200.7.10.102.64). The AjaxRestrictedCmdStat component enables a remote code execution via a POST to tools/_rcmdstat.jsp, writing to a specified filename. Impact described as high (CVSS 3.1: CRITICAL; network attack vector, no authen...

CVE-2019-19840

CVE-2019-19840 affects Ruckus Unleashed firmware up to 200.7.10.102.64; stack-based overflow in zap_parse_args (zap.c) enables remote code execution via unauthenticated HTTP requests. Root cause: stack overflow in parsing arguments; impact: remote code execution with network vector. No patch/vers...

CVE-2019-19843

CVE-2019-19843 affects Ruckus Wireless Unleashed firmware up to 200.7.10.102.64. The issue is an incorrect access control in the Web UI that allows remote credential fetch via an unauthenticated HTTP request exploiting a symlink involving /tmp and web/user/wps_tool_cache. Impact per sources inclu...

CVE-2019-19838

CVE-2019-19838 affects Ruckus Wireless Unleashed firmware (emfd) up to and including 200.7.10.102.64. The issue allows remote command execution when an attacker crafts a POST to admin/_cmdstat.jsp with the uploadFile attribute and the xcmd=get-platform-depends parameter, triggering OS commands on...

CVE-2019-19837

CVE-2019-19837 affects Ruckus Wireless Unleashed firmware up to 200.7.10.102.64. Affected component: the web interface. Root cause: incorrect access control in the web interface, which permits remote disclosure of the bin/web.conf file via HTTP requests. Impact: information disclosure of configur...

CVE-2019-19835

The CVE-2019-19835 entry describes an SSRF vulnerability in AjaxRestrictedCmdStat (zap) affecting Ruckus Wireless Unleashed through 200.7.10.102.64, enabling a remote denial of service via the server attribute to the tools/_rcmdstat.jsp URI. Affected product scope is Ruckus Unleashed firmware; ex...

CVE-2019-19839

CVE-2019-19839 affects Ruckus Wireless Unleashed emfd; a remote attacker can execute OS commands by sending a POST to admin/_cmdstat.jsp with xcmd=import-category via the uploadFile attribute. Root cause is improper handling of the xcmd=import-category parameter in emfd, enabling command executio...