CVE-2020-26879 Hardcoded credentials in n/a
An unauthenticated attacker can bypass authentication and access the service API using a hardcoded backdoor token in Ruckus vRioT.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-26879?
CVE-2020-26879 is a critical vulnerability in n/a, published on 26 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorization header.
Weakness: CWE-798
Which versions are affected by CVE-2020-26879?
It affects 1 product.
Products include Commscope Ruckus Vriot.
How do I fix CVE-2020-26879?
No fix has been published for CVE-2020-26879 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-26879 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-26879 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
Sources
Also known as GHSA-v4g7-hcw8-gwmg.