CVE-2019-19838

critical · 9.8

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=get-platform-depends to admin/_cmdstat.jsp via the uploadFile attribute.

9.8

CVSS

24.4%

EPSS (exploit prob.)

98th

EPSS percentile

2020-01-23

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
ruckuswireless	unleashed	< 200.7.10.202.94
ruckuswireless	c110	all versions
ruckuswireless	e510	all versions
ruckuswireless	h320	all versions
ruckuswireless	h510	all versions
ruckuswireless	m510	all versions
ruckuswireless	r310	all versions
ruckuswireless	r320	all versions
ruckuswireless	r510	all versions
ruckuswireless	r610	all versions
ruckuswireless	r710	all versions
ruckuswireless	r720	all versions
ruckuswireless	t310	all versions
ruckuswireless	t610	all versions
ruckuswireless	t710	all versions
ruckuswireless	zonedirector_1200_firmware	< 9.10.2.0.84
ruckuswireless	zonedirector_1200_firmware	>= 9.12.0, < 9.12.3.0.136
ruckuswireless	zonedirector_1200_firmware	>= 9.13.0, < 10.0.1.0.90
ruckuswireless	zonedirector_1200_firmware	>= 10.1.0, < 10.1.2.0.275
ruckuswireless	zonedirector_1200_firmware	>= 10.2.0, < 10.2.1.0.147
ruckuswireless	zonedirector_1200_firmware	>= 10.3.0, < 10.3.1.0.21
ruckuswireless	zonedirector_1200	all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2019-19838