CVE-2020-26878

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API (/service/v1/createUser endpoint), injecting arbitrary commands that will be executed as root user via web.py.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://adepts.of0x.ccThird Party Advisory
https://adepts.of0x.cc/ruckus-vriot-rce/Exploit, Third Party Advisory
https://support.ruckuswireless.com/documentsVendor Advisory
https://support.ruckuswireless.com/security_bulletins/305Product, Vendor Advisory
https://twitter.com/TheXC3LLThird Party Advisory
https://x-c3ll.github.ioThird Party Advisory
https://adepts.of0x.ccThird Party Advisory
https://adepts.of0x.cc/ruckus-vriot-rce/Exploit, Third Party Advisory
https://support.ruckuswireless.com/documentsVendor Advisory
https://support.ruckuswireless.com/security_bulletins/305Product, Vendor Advisory
https://twitter.com/TheXC3LLThird Party Advisory
https://x-c3ll.github.ioThird Party Advisory

Timeline

Published: Oct 26, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-268799.8Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with CVE-2020-26887.1Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (com CVE-2020-268807.8Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf conf CVE-2020-268827.5In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input.CVE-2020-268837.5In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents.CVE-2020-268846.1RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could potentially exploit CVE-2020-268856.1An issue was discovered in 2sic 2sxc before 11.22. A XSS vulnerability in the sxcver parameter of dnn/ui.html allows an attacker to craft a CVE-2020-268867.8Softaculous before 5.5.7 is affected by a code execution vulnerability because of External Initialization of Trusted Variables or Data Store CVE-2020-268877.8FRITZ!OS before 7.21 on FRITZ!Box devices allows a bypass of a DNS Rebinding protection mechanism.CVE-2020-26896.5Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior CVE-2020-268907.5Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, al CVE-2020-268916.1AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a