Check Point Advisories

Ruckus Wireless Devices Command Injection (CVE-2019-19838)

Vulnerability
Protection

Check Point Reference:	CPAI-2019-3200
Date Published:	17 Jun 2024
Severity:	Critical
Last Updated:	Monday 17 June, 2024
Source:
Industry Reference:	CVE-2019-19838
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?	Ruckus Wireless Unleashed prior to 200.7.10.202.94 Ruckus Wireless ZoneDirector 1200 firmware prior 9.10.2.0.84 Ruckus Wireless ZoneDirector 1200 firmware from 9.12.0 up to and including 9.12.3.0.136 Ruckus Wireless ZoneDirector 1200 from 9.13.0 up to 10.0.1.0.90 Ruckus Wireless ZoneDirector 1200 from 10.1.0 up to 10.1.2.0.275 Ruckus Wireless ZoneDirector 1200 from 10.2.0 up to 10.2.1.0.147 Ruckus Wireless ZoneDirector 1200 from 10.3.0 up to 10.3.1.0.21 Ruckus Wireless C110 Ruckus Wireless E510 Ruckus Wireless H320 Ruckus Wireless H510 Ruckus Wireless M510 Ruckus Wireless R310 Ruckus Wireless R320 Ruckus Wireless R510 Ruckus Wireless R610 Ruckus Wireless R710 Ruckus Wireless R720 Ruckus Wireless T310 Ruckus Wireless T610 Ruckus Wireless T710
Vulnerability Description	A command injection vulnerability exists in Ruckus Wireless devices. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system.

Protection Overview

This protection detects attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R81 / R80 / R77 / R75

In the IPS tab, click Protections and find the Ruckus Wireless Devices Command Injection (CVE-2019-19838) protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Application Servers Protection Violation.
Attack Information: Ruckus Wireless Devices Command Injection (CVE-2019-19838)