CVE-2021-33217

Name of the Vulnerable Software and Affected Versions CommScope Ruckus IoT Controller versions 1.7.1.0 and earlier

Description An issue in the Web Application of the CommScope Ruckus IoT Controller allows authenticated users to perform arbitrary read/write actions. The API endpoint allows an HTTP POST request to write arbitrary content into any file on the filesystem with root privileges.

Recommendations For CommScope Ruckus IoT Controller versions 1.7.1.0 and earlier, consider restricting access to the API endpoint that allows arbitrary file writes until a patch is available. As a temporary workaround, limit the privileges of authenticated users to prevent them from performing arbitrary read/write actions on the filesystem.