CVE Feed

    Dashboard / CVE / CVE-2020-13915

    CVE-2020-13915

    Insecure permissions in emfd/libemf in Ruckus Wireless Unleashed through 200.7.10.102.92 allow a remote attacker to overwrite admin credentials via an unauthenticated crafted HTTP request. This affects C110, E510, H320, H510, M510, R320, R310, R500, R510 R600, R610, R710, R720, R750, T300, T301n, T301s, T310c, T310d, T310n, T310s, T610, T710, and T710s devices.

    Published:Jul 28, 2020
    Last Modified:Nov 21, 2024
    EPS:Jul 28, 2020
    EPSS Score:0.00612
    CVSS Score:7.5

    Affected Products

    Vendor
    Ruckuswireless
    Product
    C110
    Vendor
    Ruckuswireless
    Product
    E510
    Vendor
    Ruckuswireless
    Product
    H320
    Vendor
    Ruckuswireless
    Product
    H510
    Vendor
    Ruckuswireless
    Product
    M510
    Vendor
    Ruckuswireless
    Product
    R310
    Vendor
    Ruckuswireless
    Product
    R320
    Vendor
    Ruckuswireless
    Product
    R500
    Vendor
    Ruckuswireless
    Product
    R510
    Vendor
    Ruckuswireless
    Product
    R600
    Vendor
    Ruckuswireless
    Product
    R610
    Vendor
    Ruckuswireless
    Product
    R710
    Vendor
    Ruckuswireless
    Product
    R720
    Vendor
    Ruckuswireless
    Product
    R750
    Vendor
    Ruckuswireless
    Product
    T300
    Vendor
    Ruckuswireless
    Product
    T301n
    Vendor
    Ruckuswireless
    Product
    T301s
    Vendor
    Ruckuswireless
    Product
    T310c
    Vendor
    Ruckuswireless
    Product
    T310d
    Vendor
    Ruckuswireless
    Product
    T310n
    Vendor
    Ruckuswireless
    Product
    T310s
    Vendor
    Ruckuswireless
    Product
    T610
    Vendor
    Ruckuswireless
    Product
    T710
    Vendor
    Ruckuswireless
    Product
    T710s
    Vendor
    Ruckuswireless
    Product
    Unleashed Firmware

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
    CAPEC-102 Session Sidejacking
    CAPEC-122 Privilege Abuse
    CAPEC-127 Directory Indexing
    CAPEC-17 Using Malicious Files
    CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels
    CAPEC-206 Signing Malicious Code
    CAPEC-234 Hijacking a privileged process
    CAPEC-474 Signature Spoofing by Key Theft
    CAPEC-50 Password Recovery Exploitation
    CAPEC-509 Kerberoasting
    CAPEC-551 Modify Existing Service
    CAPEC-555 Remote Services with Stolen Credentials
    CAPEC-560 Use of Known Domain Credentials
    CAPEC-561 Windows Admin Shares with Stolen Credentials
    CAPEC-60 Reusing Session IDs (aka Session Replay)
    CAPEC-600 Credential Stuffing
    CAPEC-61 Session Fixation
    CAPEC-62 Cross Site Request Forgery
    CAPEC-642 Replace Binaries
    CAPEC-644 Use of Captured Hashes (Pass The Hash)
    CAPEC-645 Use of Captured Tickets (Pass The Ticket)
    CAPEC-652 Use of Known Kerberos Credentials
    CAPEC-653 Use of Known Operating System Credentials

    Related CVEs

    CVE-2023-49225 (CVSS 6.1) — A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP S…
    CVE-2020-13919 (CVSS 9.8) — emfd/libemf in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to achieve command i…
    CVE-2020-13918 (CVSS 7.5) — Incorrect access control in webs in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker…
    CVE-2020-13917 (CVSS 9.8) — rkscli in Ruckus Wireless Unleashed through 200.7.10.92 allows a remote attacker to achieve command injection …
    CVE-2020-13916 (CVSS 9.8) — A stack buffer overflow in webs in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker …
    CVE-2020-13914 (CVSS 7.5) — webs in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to cause a denial of servic…
    CVE-2020-13913 (CVSS 6.1) — An XSS issue in emfd in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to execute …
    CVE-2019-19839 (CVSS 9.8) — emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a…
    CVE-2019-19838 (CVSS 9.8) — emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a…
    CVE-2019-19835 (CVSS 7.5) — SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote deni…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High