← Vulnerability feed

Vulnerability record · CVE-2019-19843 · published 22 January 2020

CVE-2019-19843: Ruckuswireless unleashed insufficiently protected credentials vulnerability

Ruckuswireless · Unleashed

Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a symlink with /tmp and web/user/wps_tool_cache.

9.8 CVSS 3.1 Critical EPSS 1.8% · top 21.6% CWE-522 · Insufficiently protected credentialsCWE-552 · CWE-552
9.8CVSS 3.1 base score, v2 7.5
1.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a symlink with /tmp and web/user/wps_tool_cache.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://alephsecurity.com/2020/01/14/ruckus-wireless ExploitTechnical DescriptionThird Party Advisory
https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html Third Party Advisory
https://www.ruckuswireless.com/security/299/view/txt Vendor Advisory
https://alephsecurity.com/2020/01/14/ruckus-wireless ExploitTechnical DescriptionThird Party Advisory
https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html Third Party Advisory
https://www.ruckuswireless.com/security/299/view/txt Vendor Advisory

Track CVE-2019-19843 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-22654Ruckuswireless r310 firmware download of code without integrity check vulnerabilityIn Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10…EPSS 0.34%9.8CVE-2020-22653Ruckuswireless r310 firmware improper verification of cryptographic signature vulnerabilityIn Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10…EPSS 0.55%9.8CVE-2020-22658Ruckuswireless r310 firmware download of code without integrity check vulnerabilityIn Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10…EPSS 0.51%9.8CVE-2019-19838Ruckuswireless unleashed os command injection vulnerabilityemfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=g…EPSS 24%9.8CVE-2019-19839Ruckuswireless unleashed os command injection vulnerabilityemfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=i…EPSS 3.3%9.8CVE-2019-19840Ruckuswireless unleashed out-of-bounds write vulnerabilityA stack-based buffer overflow in zap_parse_args in zap.c in zap in Ruckus Unleashed through 200.7.10.102.64 allows remote code execution via an unaut…EPSS 4.1%9.8CVE-2019-19841Ruckuswireless unleashed os command injection vulnerabilityemfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=p…EPSS 3.3%9.8CVE-2019-19842Ruckuswireless unleashed os command injection vulnerabilityemfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=s…EPSS 5.0%

Source: NIST National Vulnerability Database (record CVE-2019-19843), CISA KEV, FIRST EPSS (scores of 2026-10-17). This page is refreshed as NVD updates the record.