^{CVE-2020-22662:}Command injection vulnerability in Ruckus wireless access points and controllers allows attackers to execute unauthorized commands, modify region codes, and create excessive SSID interfaces.

Overview

This vulnerability affects multiple Ruckus wireless access points and controller products. The command injection vulnerability allows attackers to bypass security controls and execute unauthorized commands on the affected devices. The impact includes:

1. Ability to change and set unauthorized "illegal region codes" which can lead to operating the device at illegal frequencies with maximum output power
2. Creation of an arbitrary number of SSID WLAN interfaces per radio beyond the default limit of 8, causing overhead and noise
3. Unlocking of hidden regions through privilege command injection in the web GUI interface

The vulnerability is particularly concerning as it could allow attackers to manipulate the wireless transmission characteristics of the devices, potentially violating regulatory requirements for radio frequency usage in different regions.

Remediation

To address this vulnerability, administrators should:

1. Update affected devices to the following patched versions:

   • SmartCell Gateway 200 (SCG200): Update to version 3.6.2.0.795 or later
   • SmartZone 100 (SZ-100): Update to version 3.6.2.0.795 or later
   • SmartZone 300 (SZ300): Update to version 3.6.2.0.795 or later
   • Virtual SmartZone (vSZ): Update to version 3.6.2.0.795 or later
   • For R310, R500, R600, T300, T301n, T301s: Check with vendor for patched firmware versions

2. Implement additional security measures:

   • Restrict administrative access to the web GUI to trusted networks only
   • Implement strong authentication mechanisms
   • Monitor systems for unusual activities or configuration changes
   • Deploy network segmentation to limit access to management interfaces

3. Regularly check for and apply security updates from Ruckus as they become available

References

1. Ruckus Security Bulletin: https://support.ruckuswireless.com/security_bulletins/302
2. Vulnerability details blog post: https://hdhrmi.blogspot.com/2020/03/multiple-vulnerabilities-in-ruckus.html?m=1
3. CWE-77: Command Injection - https://cwe.mitre.org/data/definitions/77.html