Aggregates CVE and security vulnerability intelligence across all CommScope-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Historical issues mainly involve vendor risk path handling, vendor risk cross-site scripting, vendor risk ssrf, and vendor risk memory corruption and related problems; some flaws may lead to vendor impact session compromise.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2022-26998 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wps_enrolee_pin parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. | [email protected] | 9.8 | 3.45% | 2022-03-15 | 2026-06-17 |
| CVE-2022-26997 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the upnp function via the upnp_ttl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. | [email protected] | 9.8 | 3.45% | 2022-03-15 | 2026-06-17 |
| CVE-2022-26996 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pppoe function via the pppoe_username, pppoe_passwd, and pppoe_servicename parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request. | [email protected] | 9.8 | 2.88% | 2022-03-15 | 2026-06-17 |
| CVE-2022-26995 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pptp (wan_pptp.html) function via the pptp_fix_ip, pptp_fix_mask, pptp_fix_gw, and wan_dns1_stat parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request. | [email protected] | 9.8 | 2.88% | 2022-03-15 | 2026-06-17 |
| CVE-2021-41552 | CommScope SURFboard SBG6950AC2 9.1.103AA23 devices allow Command Injection. | [email protected] | 8.8 | 0.72% | 2022-02-15 | 2026-06-17 |
| CVE-2021-20119 | The password change utility for the Arris SurfBoard SB8200 can have safety measures bypassed that allow any logged-in user to change the administrator password. | [email protected] | 7.1 | 0.44% | 2021-11-09 | 2026-06-16 |
| CVE-2021-20120 | The administration web interface for the Arris Surfboard SB8200 lacks any protections against cross-site request forgery attacks. This means that an attacker could make configuration changes (such as changing the administrative password) without the consent of the user. | [email protected] | 8.8 | 0.54% | 2021-10-21 | 2026-06-16 |
| CVE-2021-33221 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Unauthenticated API Endpoints. | [email protected] | 9.8 | 56.99% | 2021-07-07 | 2026-06-16 |
| CVE-2021-33220 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. Hard-coded API Keys exist. | [email protected] | 7.8 | 0.25% | 2021-07-07 | 2026-06-16 |
| CVE-2021-33219 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded Web Application Administrator Passwords for the admin and nplus1user accounts. | [email protected] | 9.8 | 2.15% | 2021-07-07 | 2026-06-16 |
| CVE-2021-33218 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded System Passwords that provide shell access. | [email protected] | 9.8 | 2.30% | 2021-07-07 | 2026-06-16 |
| CVE-2021-33217 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The Web Application allows Arbitrary Read/Write actions by authenticated users. The API allows an HTTP POST of arbitrary content into any file on the filesystem as root. | [email protected] | 8.8 | 1.38% | 2021-07-07 | 2026-06-16 |
| CVE-2021-33216 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. An Undocumented Backdoor exists, allowing shell access via a developer account. | [email protected] | 9.8 | 13.77% | 2021-07-07 | 2026-06-16 |
| CVE-2021-33215 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The API allows Directory Traversal. | [email protected] | 4.3 | 1.19% | 2021-07-07 | 2026-06-16 |
| CVE-2020-26879 | Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorization header. | [email protected] | 9.8 | 42.48% | 2020-10-26 | 2026-06-16 |
| CVE-2020-26878 | Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API (/service/v1/createUser endpoint), injecting arbitrary commands that will be executed as root user via web.py. | [email protected] | 8.8 | 11.45% | 2020-10-26 | 2026-06-16 |
| CVE-2020-8830 | CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA-1 field on the Wireless Admin screen. | [email protected] | 8.8 | 0.51% | 2020-05-05 | 2026-06-16 |
| CVE-2020-8033 | Ruckus R500 3.4.2.0.384 devices allow XSS via the index.asp Device Name field. | [email protected] | 6.1 | 0.70% | 2020-05-05 | 2026-06-16 |
| CVE-2020-7983 | A CSRF issue in login.asp on Ruckus R500 3.4.2.0.384 devices allows remote attackers to access the panel or conduct SSRF attacks. | [email protected] | 8.1 | 0.62% | 2020-05-05 | 2026-06-16 |
| CVE-2020-9476 | ARRIS TG1692A devices allow remote attackers to discover the administrator login name and password by reading the /login page and performing base64 decoding. | [email protected] | 7.5 | 0.96% | 2020-03-04 | 2026-06-16 |