CVE-2019-19837

Vulnerability

The vulnerability is an incorrect access control flaw in the web interface of Ruckus Wireless Unleashed devices running firmware version 200.7.10.102.64 and below. An attacker can read the bin/web.conf file by sending crafted HTTP requests, which exposes sensitive configuration data including credentials. The affected models include C110, E510, H320, H510, M510, R310, R500, R510, R600, R610, R710, R720, T300, T301n, T310d, T610, T710, T710s, and likely others [1].

Exploitation

An attacker can exploit this issue remotely without any authentication. By sending specially crafted HTTP requests to the target device (typically on port 80 or 443), the attacker can retrieve the contents of bin/web.conf. The web server fails to properly enforce access controls, allowing the file to be read by anyone who can reach the device over the network. According to the research, thousands of devices are exposed on the internet and can be targeted directly [1].

Impact

Successful exploitation results in disclosure of the web configuration file, which contains sensitive information such as administrator credentials (usernames and passwords). An attacker can use these credentials to log into the web interface and gain administrative control over the device. This is a critical information disclosure that can lead to full device compromise, as demonstrated in the referenced research [1].

Mitigation

Ruckus has not released a patch specifically for CVE-2019-19837 as of the publication date of the reference. The vendor's advisory page [2] does not provide any fix details. Affected users should monitor for firmware updates from Ruckus. Until a patch is available, restricting network access to the device via firewall rules or placing it behind a VPN can reduce exposure. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.