Published:2023/12/01 Last Updated:2023/12/01
JVN#45891816
Ruckus Access Point vulnerable to cross-site scripting
Overview
Ruckus Access Point contains a cross-site scripting vulnerability.
Products Affected
The following Ruckus Access Points are affected by this vulnerability.
- ZoneDirector: versions 10.5.1 and earlier
- SmartZone: versions 6.1.1 and earlier
- AP Solo:
- R750, R650, R730, T750 versions 114.0.0.0.6565 and earlier
- R550, R850, T750SE versions 114.0.0.0.5585 and earlier
- R510, T310D, E510, C110, R320, H510, H320, T310S, T310N, T310C, T305, M510 versions 114.0.0.0.6565 and earlier
- R720, R710, T710, T710s, T610, T610s, R610 versions 114.0.0.0.6565 and earlier
- R310 versions 110.0.0.0.2014 and earlier
- R760 versions 118.1.0.0.1274 and earlier
- R560 versions 118.1.0.0.1908 and earlier
- H550 versions 116.0.0.0.1506 and earlier
- H350 versions 116.0.0.0.3128 and earlier
- T350c versions 116.0.0.0.1543 and earlier
- T350d versions 116.0.0.0.1543 and earlier
- T350se versions 116.0.0.0.3136 and earlier
- R350 versions 116.0.0.0.1655 and earlier
Description
Ruckus Access Point provided by CommScope, Inc. contains a cross-site scripting vulnerability (CWE-79).
Impact
An arbitrary script may be executed on the web browser of the user who is logging in the product.
Solution
Update the Software
Update the software to the latest version according to the information provided by the developer.
The developer addressed the vulnerability in the following versions:
- ZoneDirector 10.5.1.0.255 or later
- SmartZone 6.1.2 or later
- AP Solo 118.2.0.0.875
Vendor Status
| Vendor | Link |
| CommScope, Inc. | Security Bulletin 20231128 |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
CVSS v3
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score:
6.1
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
CVSS v2
AV:N/AC:H/Au:N/C:N/I:P/A:N
Base Score:
2.6
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Credit
MUNEHIRO SHIRATANI of AGEST,Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2023-49225 |
| JVN iPedia |
JVNDB-2023-000119 |