Overview
Description
Multiple critical vulnerabilities have been discovered by independent security researcher Aiman Yahya Al-Hadhrami from the Republic of Yemen, a student at the University of Science and Technology, Sana'a. These vulnerabilities affect CommScope and Ruckus products.
The discovered issues include flaws in the Secure Boot mechanism and the Web GUI interface, which allow a remote attacker to bypass authentication and perform firmware upgrades using unauthorized images.
A total of 10 CVEs have been identified, with Base Scores indicating Critical Impact:
CVE-2020-22653 Base Score: 9.8 CRITICALImpact/Risk
° The attacker can gain access to anywhere from thousands to millions of devices worldwide by exploiting a security vulnerability that allows them to identify these devices and their IP addresses. These devices send signals to the manufacturer, which the attacker can intercept to locate and target them. Once access is obtained, the attacker can implant modified firmware containing malicious commands to carry out cyberattacks. This firmware may also include spyware or data-stealing malware for espionage purposes. Additionally, the attacker may use these compromised devices as part of a botnet to launch DDoS attacks, overwhelming target systems with traffic.
° The vulnerabilities affected multiple devices, servers, and systems used in various sectors, including government offices, airports, hotels, companies, and hospitals around the world. If an attacker exploits these vulnerabilities in the healthcare sector, it could lead to severe consequences, including the disruption of medical devices and access to healthcare systems. Such attacks could cripple hospital network infrastructure, resulting in delays in medical procedures and critical care. In worst-case scenarios, this may lead to breaches of emergency systems, operating rooms, and intensive care units, potentially causing loss of lives.
° Illegal RF Operation: An attacker can configure the device to operate on illegal frequencies with unrestricted output power, violating air interface regulations, including FCC rules: 594280 D01, 594280 D02, and 442812 D01. Exploiting this vulnerability in sensitive locations such as airports could lead to severe consequences, including interference with radar systems and other critical communication channels, potentially causing operational disruptions and safety hazards.
° Attackers can remotely take over systems, compromising them from the lowest operating and security layers up to the highest levels, resulting in complete device compromises that victims—including even the manufacturer—cannot recover from without the attacker’s cooperation.
Moreover, neither the victims nor even the manufacturer can detect that the system is under unauthorized control, as the attacker’s code carries a signature that appears to have been legitimately issued by the company.
° Full remote compromise allows devices to be fully and remotely controlled by an attacker. Persistent backdoors can be implanted for various malicious purposes. Furthermore, future software updates can be permanently blocked by the attacker, preventing any remediation, and in the worst cases, the attacker may even brick the devices beyond repair, necessitating their complete replacement.
Responsible Disclosure
Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200
10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151.
The following table outlines the vulnerable Ruckus products, the affected software versions, and the recommended mitigation actions:
Solution
- CommScope has released patches for some products and is in the process of developing and releasing software fixes for all affected products. We recommend installing these updates as soon as they become available.
- EOL (End-of-Life) Products will not receive fix patches.
No comments:
Post a Comment