CVE-2020-22658

Imagine the device has a “startup checklist” that’s supposed to ensure only trusted software runs. This bug lets an attacker swap that trusted software with their own before the device starts, so the attacker can effectively take over the device and keep control even after reboots. For a small business, that can mean the network equipment no longer behaves reliably and may be used to attack other systems.

This matters if your small business uses Ruckus networking/security devices running the vulnerable firmware versions listed for Ruckus R310, R500, R600, T300, T301n, T301s, SmartCell Gateway 200 (SCG200), SmartZone SZ-100, SmartZone SZ-300, or Virtual SmartZone (vSZ). The issue is reachable over the network without authentication and without any user action, meaning attackers may not need to “log in” first.

Because exploitation requires the device/feature to be reachable from the attacker’s network path, the risk is highest when those devices are exposed to the internet or an untrusted network segment.

This is RED because exploitation has been reported in the wild, and attackers can manipulate boot to gain full control of affected devices. The attack is also network-based and does not require authentication or user interaction, which increases the chance of opportunistic compromise. Patch as a top priority.

1. Confirm affected hardware and firmware

   • Identify which models you run: Ruckus R310, R500, R600, T300, T301n, T301s, SmartCell Gateway 200 (SCG200), SmartZone SZ-100, SmartZone SZ-300, and vSZ.
   • For the SmartZone/SCG/vSZ family, confirm whether your firmware is before 3.6.2.0.795.

2. Validate exposure (reachability)

   • Determine whether these devices are reachable from untrusted networks (especially the public internet) and whether any management interfaces are exposed.
   • Prioritize devices that are reachable from outside your organization.

3. Upgrade to the fixed versions

   • Update SCG200 firmware to 3.6.2.0.795.
   • Update SZ-100 firmware to 3.6.2.0.795.
   • Update SZ-300 firmware to 3.6.2.0.795.
   • Update vSZ firmware to the corresponding fixed 3.6.2.0.795 guidance (the fixed version list explicitly includes vSZ under 3.6.2.0.795).
   • After upgrade, verify the reported firmware version on each affected device.

4. Temporary mitigation if patching is delayed

   • Restrict network access to affected devices so they are not reachable from the internet or other untrusted networks.
   • Ensure only intended admin networks can reach management services.

5. What to monitor after remediation

   • Look for signs of unusual device behavior (unexpected configuration changes, loss of normal connectivity, or device instability) around the upgrade window.
   • Review any available device/system logs for boot-time or image/authentication-related failures.

Note on timing: No CISA KEV listing was provided for this CVE in the findings, so remediation timing is driven by the reported exploitation activity rather than a KEV due date.

Severity is CRITICAL (reported CVSS 9.8) and the weakness is tied to verified boot bypass (the findings describe replacing the primary verified boot image with an unauthorized one). The attack vector is over the network and requires no authentication and no user interaction, which aligns with the high-risk remote takeover scenario.

Real-world exploitation: Reported exploitation has been confirmed in reporting associated with actor UAT-7810, including use to gain initial access and expanding targeting of SOHO/routers.

Fix availability: Ruckus guidance identifies firmware fixed in 3.6.2.0.795 for SCG200, SZ-100, SZ-300, and vSZ. No public exploit code was found in the provided findings, but that does not reduce risk given exploitation reports.

KEV: This CVE was not listed in the CISA KEV set based on the provided findings, but exploitation reporting still drives urgency.