Improper Verification of Cryptographic Signature in CommScope products - CVE-2020-22653

Vulnerability identifier: #VU137222

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-22653

CWE-ID: CWE-347

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper verification of cryptographic signature. A remote attacker can exploit the official image signature to force injection unauthorized image signature.

SmartZone 300 (SZ300)
ZoneDirector 1100
ZoneDirector 5000
ZoneDirector 1200
ZoneDirector 3000
Ruckus R500
Ruckus R600
Ruckus T300
Ruckus T301n
Ruckus T301s
SmartCell Gateway 200 (SCG200)
SmartZone 100 (SZ-100)
Virtual SmartZone (vSZ)
Ruckus R310

Install updates from vendor's website.

SmartZone 300 (SZ300) - update to 3.6.2.0.795
SmartCell Gateway 200 (SCG200) - update to 3.6.2.0.795
SmartZone 100 (SZ-100) - update to 3.6.2.0.795
Virtual SmartZone (vSZ) - update to 3.6.2.0.795

• https://hdhrmi.blogspot.com/2020/03/multiple-vulnerabilities-in-ruckus.html?m=1
• https://support.ruckuswireless.com/security_bulletins/302

• Multiple vulnerabilities in CommScope Ruckus products