CVE-2020-26879

CRITICAL EXPLOITED IN THE WILD NUCLEI

Ruckus vRioT <1.5.1.0.21 - RCE

Title source: llm

Description

Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorization header.

Exploits (1)

vulncheck_xdb WORKING POC
remote
https://github.com/beyefendi/exploit

Nuclei Templates (1)

Ruckus vRioT IoT Controller - Authentication Bypass
CRITICALVERIFIEDby DhiyaneshDk
Shodan: html:"RIoT Controller"

References (6)

Scores

CVSS v3 9.8
EPSS 0.8829
EPSS Percentile 99.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2022-06-28
InTheWild.io 2022-07-06
CWE
CWE-798
Status published
Products (1)
commscope/ruckus_vriot < 1.5.1.0.21
Published Oct 26, 2020
Tracked Since Feb 18, 2026