CommScope Ruckus IoT Controller 1.7.1.0 Web Application Arbitrary Read/Write

Posted on 27 May 2021

The IoT Controller web application includes a NodeJS module, node-red, which has the capability for users to read or write to local files on the IoT Controller. With the elevated privileges the web application runs as, this allowed for reading and writing to any file on the IoT Controller filesystem.