CVE-2020-26878

HIGH EXPLOITED IN THE WILD

Ruckus <1.5.1.0.21 - Command Injection

Title source: llm

Exploitation Summary

CVE-2020-26878 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 3 public exploits from researchers including X-C3LL, htarsoo.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2020-26878, demonstrating a command injection vulnerability in the user creation endpoint of an unspecified service. The exploit uses a crafted JSON payload to execute arbitrary commands, including user creation and privilege escalation via sudoers modification.

Description

Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API (/service/v1/createUser endpoint), injecting arbitrary commands that will be executed as root user via web.py.

Exploits (3)

github WORKING POC 11 stars

by X-C3LL · pythonpoc

https://github.com/X-C3LL/PoC-CVEs/tree/master/CVE-2020-26878 & CVE-2020-26879

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2020-26878, demonstrating a command injection vulnerability in the user creation endpoint of an unspecified service. The exploit uses a crafted JSON payload to execute arbitrary commands, including user creation and privilege escalation via sudoers modification.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Unspecified service (likely a web application with a user creation endpoint)

Auth required

Prerequisites: Access to the target endpoint · Valid authorization token

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 27, 2026 Full analysis →

nomisec WORKING POC

by htarsoo · remote

https://github.com/htarsoo/CVE-2020-26878

View Code ZIP pw:eip

This PoC exploits a command injection vulnerability in Ruckus IoT Controller (vRIoT) versions <= 1.5.1.0.21, leveraging broken authentication to achieve remote code execution via a crafted payload in the username field.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Ruckus IoT Controller (Ruckus vRIoT) <= 1.5.1.0.21

No auth needed

Prerequisites: Network access to the target · Python 3 environment · Listener setup for reverse shell

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 16, 2026 Full analysis →

vulncheck_xdb WORKING POC

remote-auth

https://github.com/beyefendi/exploit

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2020-26878, targeting Ruckus IoT Controller (Ruckus vRIoT) versions <= 1.5.1.0.21. The exploit leverages command injection and broken authentication to achieve remote code execution (RCE) as root.

Classification

Working Poc 100%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Ruckus IoT Controller (Ruckus vRIoT) <= 1.5.1.0.21

No auth needed

Prerequisites: Target IP and port · Attacker IP and port for reverse shell · Netcat listener on attacker machine

MITRE ATT&CK