CVE-2020-22653

Think of this bug like a lock on the device that should only accept “official” software updates. The weakness lets an attacker trick that update process so the device accepts an unauthorized firmware image. If that happens, the attacker can effectively take over the device and potentially disrupt your network or keep control even after normal changes.

This matters if you operate any of the listed Ruckus firmware devices (Ruckus R310/R500/R600, Ruckus T300/T301n/T301s, SmartCell Gateway 200 (SCG200), and SmartZone 100/300 and Virtual SmartZone) on the vulnerable firmware versions described. Because the issue can be triggered over the network without authentication or user interaction, it’s most relevant when an attacker can reach the device’s management/update-related network exposure. The practical risk depends on whether the vulnerable functionality is reachable from the network in your environment.

This is RED because the flaw can allow remote unauthorized firmware/image installation, which can lead to full device compromise (not just a minor issue). Even without publicly documented exploit code, there’s sustained security attention and evidence of vulnerability exploitation disclosure involving Ruckus routers, so you should treat this as an active, serious threat. Act immediately to move off the vulnerable firmware versions.

1. Confirm exposure (find affected devices)

   • On each Ruckus device/controller, record the exact firmware version.
   • Check specifically:
     • Ruckus R310 / R500 / R600 running 10.5.1.0.199
     • Ruckus T300 / T301n / T301s running 10.5.1.0.199
     • SCG200 running anything before 3.6.2.0.795
     • SZ-100 running anything before 3.6.2.0.795
     • SZ-300 running anything before 3.6.2.0.795
     • vSZ running anything before 3.6.2.0.795

2. Choose the fixed version(s)

   • For SCG200 / SZ-100 / SZ-300 / vSZ, the known fixed version is: 3.6.2.0.795.
   • For Ruckus R310/R500/R600 and T300/T301n/T301s on 10.5.1.0.199, use the vendor security bulletin to identify the exact fixed release line for each model, since this CVE description centers on the vulnerable specific firmware build.
   • Vendor bulletin referenced by the findings: https://support.ruckuswireless.com/security_bulletins/302

3. Upgrade safely

   • Plan a maintenance window (firmware upgrades can temporarily interrupt management/network services).
   • Ensure you can access the device after reboot (out-of-band access if available).
   • Upgrade one device at a time if you have multiple controllers or roles that can be staggered.
   • After upgrade completion, re-check the firmware version displayed by the device.

4. Temporary workaround (only while patching is delayed)

   • Since the weakness is reachable via the network and involves image/management surfaces, reduce exposure by restricting network access to the management/update interfaces so only trusted admin networks/systems can reach them.
   • Monitor for unexpected management changes during the patch delay.

5. What to monitor after upgrading

   • Confirm no unexpected reboots or configuration changes occurred around the time of any suspicious activity.
   • Review management event logs for signs of unauthorized update attempts (if your device provides those logs).

6. Timeline guidance from findings

   • There is no CISA KEV listing for this CVE in the findings provided, but the traffic-light verdict is RED and the vendor has a published security bulletin; prioritize patching immediately based on internal risk and exposure.

CVE-2020-22653 targets multiple Ruckus firmware products and is rated critical in the provided context. The weakness is related to bypassing an expected trust boundary in the “official image signature” process (CWE-347), enabling an attacker to force injection of an unauthorized image signature. The findings state remote code execution/system compromise is possible through unauthorized firmware/image installation, with no authentication and no user interaction required.

Exploitation details in findings: no public exploit code is on record, KEV does not list it, and there is no clear dated press claim of exploitation; however, vulnerability exploitation disclosure in the press involving Ruckus routers and sustained security attention are noted, along with a PULSE actor reference. EPSS is mentioned as a prediction (not used as a deciding factor in the public-facing guidance).

Practical attack vector (from findings): network-based trigger, contingent on the target running a vulnerable firmware/software version and on the relevant functionality being reachable in the environment.