Use of hard-coded credentials in Ruckus IoT Controller - CVE-2021-33216
Published: May 28, 2021
Vulnerability identifier: #VU53642
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-33216
CWE-ID: CWE-798
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain full access to vulnerable system.
The vulnerability exists due to presence of hard-coded credentials for an upgrade account. A remote unauthenticated attacker can gain access to the controller via Secure Copy (SCP).
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Ruckus IoT Controller
How to mitigate CVE-2021-33216
Install updates from vendor's website.
Ruckus IoT Controller - update to R1.8.0.0