Don't Ruck Us Again: The Exploit Returns
Gal Zror discloses six new vulnerabilities in Ruckus Wireless ZoneDirector and Unleashed access points, achieving unauthenticated root RCE over the air.
Summary
Revisiting Enterprise Wi-Fi Controller Security
Following earlier disclosures in enterprise wireless infrastructure, Gal Zror conducts a comprehensive follow-up audit of Ruckus Wireless ZoneDirector and Unleashed firmware.
Discovering Six New Critical Vulnerabilities
Zror reveals a chain of six distinct flaws—spanning command injection, information leakage, credential overwrites, stack buffer overflows, and stored XSS.
Unauthenticated Root Code Execution
Chaining pre-authentication web handler bugs allows an unauthenticated network attacker to overwrite administrative credentials and execute arbitrary root shellcode on access points.
Vendor Patch Analysis and Fleet Hardening
The author reviews vendor security patches, providing wireless network engineers with detection signatures to audit enterprise Wi-Fi deployments.
Related talks
Main Stage·27 min
Gal Zror
Gal Zror answers community questions regarding Ruckus Wireless ZoneDirector vulnerabilities, firmware exploitation, and patch verification.
Main Stage·43 min
Daniel Jensen
Daniel Jensen details hunting for vulnerabilities across Aruba's on-premises network management and wireless controller appliances, uncovering pre-auth RCE.
Main Stage·39 min
Octavio Gianatiempo · Octavio Galland
Octavio Gianatiempo and Octavio Galland audit top-selling consumer routers, discovering systemic OEM firmware vulnerabilities that enable zero-click remote RCE.