CVE-2017-6223 : Security Advisory and Response

Ruckus Wireless Zone Director Controller firmware versions ZD9.9.x, ZD9.10.x, and ZD9.13.0.x have OS Command Injection vulnerabilities that could allow unauthorized privileged commands.

Understanding CVE-2017-6223

What is CVE-2017-6223?

The firmware versions ZD9.9.x, ZD9.10.x, and ZD9.13.0.x of Ruckus Wireless Zone Director Controller have OS Command Injection vulnerabilities within the ping function, enabling local authenticated users to execute unauthorized privileged commands on the underlying operating system.

The Impact of CVE-2017-6223

These vulnerabilities may lead to unauthorized access and execution of privileged commands, posing a significant security risk to affected systems.

Technical Details of CVE-2017-6223

Vulnerability Description

The firmware releases ZD9.9.x, ZD9.10.x, and ZD9.13.0.x less than 9.13.0.0.232 contain OS Command Injection vulnerabilities in the ping functionality.

Affected Systems and Versions

Product: Zone Director Controller Firmware
Vendor: Brocade Communications Systems, Inc.
Versions: ZD9.9.x, ZD9.10.x, ZD9.13.0.x

Exploitation Mechanism

Local authenticated users can exploit these vulnerabilities to run unauthorized privileged commands on the underlying operating system.

Mitigation and Prevention

Immediate Steps to Take

Upgrade to firmware version 9.13.0.0.232 or later to mitigate the vulnerabilities.
Implement strong access controls to limit the impact of potential exploitation.

Long-Term Security Practices

Regularly monitor and update firmware to address security flaws promptly.
Conduct security training for users to recognize and report suspicious activities.

Patching and Updates

Apply security patches and updates provided by Brocade Communications Systems, Inc. to address the OS Command Injection vulnerabilities.