SAM Seamless Network (SAM), the global leader of cloud-native security and intelligence services for unmanaged networks and IoTs, has discovered a vulnerability affecting 31 networking products from RUCKUS Networks, part of CommScope, a provider of products and solutions for wired and wireless networks. By exploiting this vulnerability an attacker can remotely gain full control over these Ruckus network devices. SAM has reported its findings to Ruckus, and is now disclosing them publicly after Ruckus had taken the necessary steps to rectify the situation.
The authenticated remote command execution vulnerability was found in the “Ruckus Unleashed” product line’s firmware (R510_200.14.6.1.179), and 31 products that are using the same web-based management interface version of Ruckus Unleashed are affected.
SAM‘s cybersecurity researchers discovered the flaw in an internal daemon associated with the web server, which manifests itself while parsing specific messages within one of the web components. The exploit can be triggered relatively quickly, if the attacker has LAN/WAN access to the AP’s management interface. Upon successful exploitation, an attacker gains full control over the remote Ruckus Unleashed device, obtaining a fully privileged root shell.
CIO INFLUENCE: CIO Influence Interview with Lior Yaari, CEO and Co-Founder at Grip Security
This vulnerability exposes networks based on the affected devices to the risk of an attacker installing malware on the Ruckus AP, or gaining unauthorized access to the Ruckus mesh topology, connected client traffic, and other critical information.
SAM had reached out to Ruckus and provided its findings. Ruckus had promptly responded, and had communicated effectively with SAM from the initial vulnerability submission until the resolution of this issue. Ruckus‘ disclosure of this vulnerability and additional details on relevant patches related to affected products can be found in Ruckus’ Security Bulletin 20230731 at this link.
SAM‘s cybersecurity solutions, which are protecting home and business networks at some of the world’s largest ISPs, secure the network by protecting the router, the network and the devices connected to the network – and require no software installation on any of the end user‘s devices. SAM‘s device fingerprinting technology is used to identify the devices on the network and any change in device roster, and enables not only constant awareness to any abnormal device or network behavior, but a truly seamless and automated “no touch” user onboarding and continuous operation.
CIO INFLUENCE: CIO Influence Interview with Russ Ernst, Chief Technology Officer at Blancco
“SAM has a proactive approach to IoT security, and an ongoing commitment to detect and defend against cybersecurity attacks, invasion of privacy, and personal information theft,” said Sivan Rauscher, CEO and Co-founder of SAM Seamless Network. “Having our own dedicated team of cybersecurity researchers enables SAM to not only incorporate updated cybersecurity mitigation practices within our solutions when they are provided by device vendors, but also actively discover new vulnerabilities in network-attached devices, investigate them, alert the relevant vendor, responsibly disclose the vulnerabilities to the cybersecurity community, and collaborate with relevant stakeholders on rectifying the vulnerabilities.”
“Known device vulnerabilities that have already been resolved by their vendors are being mitigated by default,” explains Nadav Lieberman, SAM‘s VP Data and Innovation. “However, when a new vulnerability is discovered – either by us or another party – and a patch is not issued by the vendor immediately, we create and apply the appropriate mitigation process, which can be a network policy update, code injection, etc., and use Hot Patching to secure the affected devices until an official patch is deployed by the vendor. SAM‘s hot patching really shines when it comes to secure IoT devices, known to be very challenging to secure and update, but it is especially critical when dealing with devices that are no longer supported by their vendor (“End of life“) but are still at risk due to new vulnerabilities affecting them.”
SAM wishes to recognize the outstanding and comprehensive research that has been done by “alephsecurity” in discovering prior exploits in Ruckus‘ products, which proved to be an important supporting asset to SAM‘s research efforts during the recent discovery.
CIO INFLUENCE: CIO Influence Interview with Bill Lobig, VP of Product Management at IBM Automation
[To share your insights with us, please write to sghosh@martechseries.com]
